Detection rules › Sigma

Sigma rules: 10

Rule	Severity
.Class Extension URI Ending Request	`medium`
Active Directory Database Snapshot Via ADExplorer	`medium`
ADSI-Cache File Creation By Uncommon Tool	`medium`
Attempt To Create API Key	`medium`
AWS EKS Cluster Created or Deleted	`low`
Azure Virtual Network Device Modified or Deleted	`medium`
Computer System Reconnaissance Via Wmic.EXE	`medium`
Creation of a Local Hidden User Account by Registry	`high`
Download From Suspicious TLD - Whitelist	`low`
File In Suspicious Location Encoded To Base64 Via Certutil.EXE	`high`
Kubernetes Rolebinding Modification	`medium`
Log4j RCE CVE-2021-44228 in Fields	`high`
Msiexec Quiet Installation	`medium`
Network Connection Initiated To DevTunnels Domain	`medium`
Nslookup PowerShell Download Cradle	`medium`
Php Inline Command Execution	`medium`
Potential appverifUI.DLL Sideloading	`high`
Potential Discovery Activity Using Find - MacOS	`medium`
Potential KamiKakaBot Activity - Lure Document Execution	`medium`
Potential Webshell Creation On Static Website	`medium`
Potentially Suspicious Execution Of PDQDeployRunner	`medium`
PSScriptPolicyTest Creation By Uncommon Process	`medium`
Recon Information for Export with Command Prompt	`medium`
Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate	`medium`
Remote XSL Execution Via Msxsl.EXE	`high`
Removal of Potential COM Hijacking Registry Keys	`medium`
Serpent Backdoor Payload Execution Via Scheduled Task	`high`
Service Installed By Unusual Client - Security	`high`
Suspicious Diantz Download and Compress Into a CAB File	`medium`
Suspicious File Access to Browser Credential Storage	`low`
Suspicious Inbox Forwarding	`low`
Suspicious MSExchangeMailboxReplication ASPX Write	`high`
Suspicious NTLM Authentication on the Printer Spooler Service	`high`
Suspicious PowerShell Download - PoshModule	`medium`
System Shutdown/Reboot - Linux	`informational`
Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location	`low`
UAC Bypass Using Windows Media Player - Process	`high`
UNC2452 PowerShell Pattern	`critical`
Ursnif Malware Download URL Pattern	`high`
Use of UltraVNC Remote Access Software	`medium`
User Added to Local Administrator Group	`medium`
User Shell Folders Registry Modification via CommandLine	`high`

.Class Extension URI Ending Request

Status: test
Severity: medium
Author: Andreas Hunkeler (@Karneades)
Source: github.com/SigmaHQ/sigma

Detects requests to URI ending with the ".class" extension in proxy logs. This could rules can be used to hunt for potential downloads of Java classes as seen for example in Log4shell exploitation attacks against Log4j.

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	No specific technique

Rule Body

title: .Class Extension URI Ending Request
id: 53c15703-b04c-42bb-9055-1937ddfb3392
status: test
description: |
    Detects requests to URI ending with the ".class" extension in proxy logs.
    This could rules can be used to hunt for potential downloads of Java classes as seen for example in Log4shell exploitation attacks against Log4j.
references:
    - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
author: Andreas Hunkeler (@Karneades)
date: 2021-12-21
modified: 2024-02-26
tags:
    - attack.initial-access
    - detection.threat-hunting
logsource:
    category: proxy
detection:
    selection:
        c-uri|endswith: '.class'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    c-uri|endswith: '.class'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`c-uri`	ends_with	`.class`	`field:"c-uri" kind:ends_with value:".class"`

Active Directory Database Snapshot Via ADExplorer

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

MITRE ATT&CK Coverage

Tactic	Techniques
Discovery	`T1069.002` Permission Groups Discovery: Domain Groups `T1087.002` Account Discovery: Domain Account `T1482` Domain Trust Discovery

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Active Directory Database Snapshot Via ADExplorer
id: 9212f354-7775-4e28-9c9f-8f0a4544e664
related:
    - id: ef61af62-bc74-4f58-b49b-626448227652
      type: derived
status: test
description: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.
references:
    - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
    - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
    - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24
    - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/
    - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
    - https://trustedsec.com/blog/adexplorer-on-engagements
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-14
modified: 2025-07-09
tags:
    - attack.discovery
    - attack.t1087.002
    - attack.t1069.002
    - attack.t1482
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\ADExp.exe'
              - '\ADExplorer.exe'
              - '\ADExplorer64.exe'
              - '\ADExplorer64a.exe'
        - OriginalFileName: 'AdExp'
        - Description: 'Active Directory Editor'
        - Product: 'Sysinternals ADExplorer'
    selection_cli:
        CommandLine|contains: 'snapshot'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith:
          - '\ADExp.exe'
          - '\ADExplorer.exe'
          - '\ADExplorer64.exe'
          - '\ADExplorer64a.exe'
    - OriginalFileName: 'AdExp'
    - Description: 'Active Directory Editor'
    - Product: 'Sysinternals ADExplorer'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: 'snapshot'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`snapshot` corpus 3 (sigma 3)	`field:"CommandLine" kind:match value:"snapshot"`
`Description`	eq	`Active Directory Editor` corpus 2 (sigma 2)	`field:"Description" kind:eq value:"Active Directory Editor"`
`Image`	ends_with	`\ADExp.exe` corpus 3 (sigma 3) `\ADExplorer.exe` corpus 4 (sigma 4) `\ADExplorer64.exe` corpus 4 (sigma 4) `\ADExplorer64a.exe` corpus 4 (sigma 4)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`AdExp` corpus 2 (sigma 2)	`field:"OriginalFileName" kind:eq value:"AdExp"`
`Product`	eq	`Sysinternals ADExplorer` corpus 2 (sigma 2)	`field:"Product" kind:eq value:"Sysinternals ADExplorer"`

ADSI-Cache File Creation By Uncommon Tool

Status: test
Severity: medium
Author: xknow @xknow_infosec, Tim Shelton
Source: github.com/SigmaHQ/sigma

Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.

Known False Positives

Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc.

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1001.003` Data Obfuscation: Protocol or Service Impersonation

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule Body

title: ADSI-Cache File Creation By Uncommon Tool
id: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb
status: test
description: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.
references:
    - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
    - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
    - https://github.com/fox-it/LDAPFragger
author: xknow @xknow_infosec, Tim Shelton
date: 2019-03-24
modified: 2023-10-18
tags:
    - attack.t1001.003
    - attack.command-and-control
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '\Local\Microsoft\Windows\SchCache\'
        TargetFilename|endswith: '.sch'
    filter_main_generic:
        - Image|endswith:
              - ':\Program Files\Cylance\Desktop\CylanceSvc.exe'
              - ':\Windows\CCM\CcmExec.exe'
              - ':\windows\system32\dllhost.exe'
              - ':\Windows\system32\dsac.exe'
              - ':\Windows\system32\efsui.exe'
              - ':\windows\system32\mmc.exe'
              - ':\windows\system32\svchost.exe'
              - ':\Windows\System32\wbem\WmiPrvSE.exe'
              - ':\windows\system32\WindowsPowerShell\v1.0\powershell.exe'
        - Image|contains:
              - ':\Windows\ccmsetup\autoupgrade\ccmsetup' # C:\Windows\ccmsetup\autoupgrade\ccmsetup.TMC00002.40.exe
              - ':\Program Files\SentinelOne\Sentinel Agent' # C:\Program Files\SentinelOne\Sentinel Agent 21.7.7.40005\SentinelAgent.exe
    filter_main_office:
        Image|contains|all:
            - ':\Program Files\'
            - '\Microsoft Office'
        Image|endswith: '\OUTLOOK.EXE'
    filter_optional_ldapwhoami:
        Image|endswith: '\LANDesk\LDCLient\ldapwhoami.exe'
    filter_optional_citrix:
        # Example:
        #   TargetFilename=C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\SchCache\REDACTED.com.sch
        Image|endswith: ':\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    TargetFilename|contains: '\Local\Microsoft\Windows\SchCache\'
    TargetFilename|endswith: '.sch'

Stage 2: `not filter_main_*`

filter_main_generic:
    - Image|endswith:
          - ':\Program Files\Cylance\Desktop\CylanceSvc.exe'
          - ':\Windows\CCM\CcmExec.exe'
          - ':\windows\system32\dllhost.exe'
          - ':\Windows\system32\dsac.exe'
          - ':\Windows\system32\efsui.exe'
          - ':\windows\system32\mmc.exe'
          - ':\windows\system32\svchost.exe'
          - ':\Windows\System32\wbem\WmiPrvSE.exe'
          - ':\windows\system32\WindowsPowerShell\v1.0\powershell.exe'
    - Image|contains:
          - ':\Windows\ccmsetup\autoupgrade\ccmsetup'
          - ':\Program Files\SentinelOne\Sentinel Agent'
filter_main_office:
    Image|contains|all:
        - ':\Program Files\'
        - '\Microsoft Office'
    Image|endswith: '\OUTLOOK.EXE'

Stage 3: `not filter_optional_*`

filter_optional_ldapwhoami:
    Image|endswith: '\LANDesk\LDCLient\ldapwhoami.exe'
filter_optional_citrix:
    Image|endswith: ':\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`.sch`	`field:"TargetFilename" kind:ends_with value:".sch"`
`TargetFilename`	match	`\Local\Microsoft\Windows\SchCache\`	`field:"TargetFilename" kind:match value:"\Local\Microsoft\Windows\SchCache\"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`\OUTLOOK.EXE`	`excludes:Image` `field:"Image" value:"\OUTLOOK.EXE"`
`Image`	match	`:\Program Files\`	`excludes:Image` `field:"Image" value:":\Program Files\"`
`Image`	match	`\Microsoft Office`	`excludes:Image` `field:"Image" value:"\Microsoft Office"`
`Image`	ends_with	`:\Program Files\Cylance\Desktop\CylanceSvc.exe`	`excludes:Image` `field:"Image" value:":\Program Files\Cylance\Desktop\CylanceSvc.exe"`
`Image`	ends_with	`:\Windows\CCM\CcmExec.exe`	`excludes:Image` `field:"Image" value:":\Windows\CCM\CcmExec.exe"`
`Image`	ends_with	`:\Windows\System32\wbem\WmiPrvSE.exe`	`excludes:Image` `field:"Image" value:":\Windows\System32\wbem\WmiPrvSE.exe"`
`Image`	ends_with	`:\Windows\system32\dsac.exe`	`excludes:Image` `field:"Image" value:":\Windows\system32\dsac.exe"`
`Image`	ends_with	`:\Windows\system32\efsui.exe`	`excludes:Image` `field:"Image" value:":\Windows\system32\efsui.exe"`
`Image`	ends_with	`:\windows\system32\WindowsPowerShell\v1.0\powershell.exe`	`excludes:Image` `field:"Image" value:":\windows\system32\WindowsPowerShell\v1.0\powershell.exe"`
`Image`	ends_with	`:\windows\system32\dllhost.exe`	`excludes:Image` `field:"Image" value:":\windows\system32\dllhost.exe"`
`Image`	ends_with	`:\windows\system32\mmc.exe`	`excludes:Image` `field:"Image" value:":\windows\system32\mmc.exe"`
`Image`	ends_with	`:\windows\system32\svchost.exe`	`excludes:Image` `field:"Image" value:":\windows\system32\svchost.exe"`
`Image`	match	`:\Program Files\SentinelOne\Sentinel Agent`	`excludes:Image` `field:"Image" value:":\Program Files\SentinelOne\Sentinel Agent"`
`Image`	match	`:\Windows\ccmsetup\autoupgrade\ccmsetup`	`excludes:Image` `field:"Image" value:":\Windows\ccmsetup\autoupgrade\ccmsetup"`
`Image`	ends_with	`:\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe`	`excludes:Image` `field:"Image" value:":\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe"`
`Image`	ends_with	`\LANDesk\LDCLient\ldapwhoami.exe`	`excludes:Image` `field:"Image" value:"\LANDesk\LDCLient\ldapwhoami.exe"`

Attempt To Create API Key

Status: test
Severity: medium
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

An attacker may have attemped to create an API key for persistence but it failed. Ex: aws appsync create-api-key --api-id ApiId I have seen this in the eventSource of appsync.amazonaws.com and apigateway.amazonaws.com. There are probably other services that can create API keys as well so I am leaving the eventSource open.

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1098.001` Account Manipulation: Additional Cloud Credentials

Rules Detecting the Same Action

These rules filter on the same operation.

API Key Created (Sigma)

Rule Body

title: Attempt To Create API Key
id: 1497f3a3-7898-484e-b1e8-22fe99efd8a4
status: test
description: |
    An attacker may have attemped to create an API key for persistence but it failed.
    Ex: aws appsync create-api-key --api-id ApiId
    I have seen this in the eventSource of `appsync.amazonaws.com` and `apigateway.amazonaws.com`.
    There are probably other services that can create API keys as well so I am leaving the eventSource open.
references:
    - https://medium.com/@adan.alvarez/distorting-the-sync-how-aws-appsync-can-be-turned-into-an-attackers-backdoor-8c015b8e52b8
    - https://traildiscover.cloud/#AppSync-CreateApiKey
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
modified: 2025-05-31
tags:
    - attack.defense-evasion
    - attack.persistence
    - attack.t1098.001 #Persistence: Additional Cloud Credentials
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'CreateApiKey'
        errorCode: 'AccessDenied'
    condition: selection
falsepositives:
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventName: 'CreateApiKey'
    errorCode: 'AccessDenied'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`errorCode`	eq	`AccessDenied`	`field:"aws::errorCode" kind:eq value:"AccessDenied"`
`eventName`	eq	`CreateApiKey`	`field:"aws::eventName" kind:eq value:"CreateApiKey"`

AWS EKS Cluster Created or Deleted

Status: test
Severity: low
Author: Austin Songer
Source: github.com/SigmaHQ/sigma

Identifies when an EKS cluster is created or deleted.

Known False Positives

EKS Cluster being created or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

MITRE ATT&CK Coverage

Tactic	Techniques
Impact	`T1485` Data Destruction

Telemetry Coverage

Platform	Record / event type
AWS	CloudTrail event `CreateCluster`: Creates a new Amazon EKS Kubernetes control plane cluster with the specified configuration.
AWS	CloudTrail event `DeleteCluster`: Deletes an Amazon EKS cluster and its associated control plane resources.

Rule Body

title: AWS EKS Cluster Created or Deleted
id: 33d50d03-20ec-4b74-a74e-1e65a38af1c0
status: test
description: Identifies when an EKS cluster is created or deleted.
references:
    - https://any-api.com/amazonaws_com/eks/docs/API_Description
author: Austin Songer
date: 2021-08-16
modified: 2022-10-09
tags:
    - attack.impact
    - attack.t1485
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: eks.amazonaws.com
        eventName:
            - CreateCluster
            - DeleteCluster
    condition: selection
falsepositives:
    - EKS Cluster being created or deleted may be performed by a system administrator.
    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: eks.amazonaws.com
    eventName:
        - CreateCluster
        - DeleteCluster

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CreateCluster` `DeleteCluster`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`eks.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"eks.amazonaws.com"`

Azure Virtual Network Device Modified or Deleted

Status: test
Severity: medium
Author: Austin Songer @austinsonger
Source: github.com/SigmaHQ/sigma

Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.

Known False Positives

Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

MITRE ATT&CK Coverage

Tactic	Techniques
Impact	No specific technique

Telemetry Coverage

Platform	Record / event type
Azure	Activity Log event `Microsoft.Network/networkInterfaces/delete`: Deletes a network interface
Azure	Activity Log event `Microsoft.Network/networkInterfaces/join/action`: Joins a Virtual Machine to a network interface. Not Alertable.
Azure	Activity Log event `Microsoft.Network/networkInterfaces/tapConfigurations/delete`: Deletes a Network Interface Tap Configuration.
Azure	Activity Log event `Microsoft.Network/networkInterfaces/tapConfigurations/write`: Creates a Network Interface Tap Configuration or updates an existing Network Interface Tap Configuration.
Azure	Activity Log event `Microsoft.Network/networkInterfaces/write`: Creates a network interface or updates an existing network interface.
Azure	Activity Log event `Microsoft.Network/networkVirtualAppliances/delete`: Delete a Network Virtual Appliance
Azure	Activity Log event `Microsoft.Network/networkVirtualAppliances/write`: Create or update a Network Virtual Appliance
Azure	Activity Log event `Microsoft.Network/virtualHubs/delete`: Deletes a Virtual Hub
Azure	Activity Log event `Microsoft.Network/virtualHubs/write`: Create or update a Virtual Hub
Azure	Activity Log event `Microsoft.Network/virtualRouters/delete`: Deletes A VirtualRouter
Azure	Activity Log event `Microsoft.Network/virtualRouters/write`: Creates A VirtualRouter or Updates An Existing VirtualRouter

Rule Body

title: Azure Virtual Network Device Modified or Deleted
id: 15ef3fac-f0f0-4dc4-ada0-660aa72980b3
status: test
description: |
    Identifies when a virtual network device is being modified or deleted.
    This can be a network interface, network virtual appliance, virtual hub, or virtual router.
references:
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
author: Austin Songer @austinsonger
date: 2021-08-08
modified: 2022-08-23
tags:
    - attack.impact
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName:
            - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE
            - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE
            - MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE
            - MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION
            - MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE
            - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE
            - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE
            - MICROSOFT.NETWORK/VIRTUALHUBS/DELETE
            - MICROSOFT.NETWORK/VIRTUALHUBS/WRITE
            - MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE
            - MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE
    condition: selection
falsepositives:
    - Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    operationName:
        - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE
        - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE
        - MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE
        - MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION
        - MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE
        - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE
        - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE
        - MICROSOFT.NETWORK/VIRTUALHUBS/DELETE
        - MICROSOFT.NETWORK/VIRTUALHUBS/WRITE
        - MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE
        - MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`operationName`	eq	`MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE` `MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION` `MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE` `MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE` `MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE` `MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE` `MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE` `MICROSOFT.NETWORK/VIRTUALHUBS/DELETE` `MICROSOFT.NETWORK/VIRTUALHUBS/WRITE` `MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE` `MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE`	`field:"operationName" kind:eq`

Computer System Reconnaissance Via Wmic.EXE

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Computer System Reconnaissance Via Wmic.EXE
id: 9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f
status: test
description: Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.
references:
    - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-08
modified: 2023-02-14
tags:
    - attack.discovery
    - attack.execution
    - attack.t1047
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains: 'computersystem'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: 'computersystem'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`computersystem`	`field:"CommandLine" kind:match value:"computersystem"`
`Image`	ends_with	`\wmic.exe` corpus 62 (sigma 62)	`field:"Image" kind:ends_with value:"\wmic.exe"`
`OriginalFileName`	eq	`wmic.exe` corpus 74 (sigma 38, elastic 18, splunk 18)	`field:"OriginalFileName" kind:eq value:"wmic.exe"`

Creation of a Local Hidden User Account by Registry

Status: test
Severity: high
Author: Christian Burkard (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Sysmon registry detection of a local hidden user account.

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1136.001` Create Account: Local Account

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 12: RegistryEvent (Object create and delete)
Sysmon	Event ID 13: RegistryEvent (Value Set)
Sysmon	Event ID 14: RegistryEvent (Key and Value Rename)

Rule Body

title: Creation of a Local Hidden User Account by Registry
id: 460479f3-80b7-42da-9c43-2cc1d54dbccd
status: test
description: Sysmon registry detection of a local hidden user account.
references:
    - https://twitter.com/SBousseaden/status/1387530414185664538
author: Christian Burkard (Nextron Systems)
date: 2021-05-03
modified: 2025-10-31
tags:
    - attack.persistence
    - attack.t1136.001
logsource:
    product: windows
    category: registry_event
detection:
    selection:
        TargetObject|contains: '\SAM\SAM\Domains\Account\Users\Names\'
        TargetObject|endswith: '$\(Default)'
        Image|endswith: '\lsass.exe'
    condition: selection
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/info.yml
simulation:
    - type: atomic-red-team
      name: Create Hidden User in Registry
      technique: T1564.002
      atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|contains: '\SAM\SAM\Domains\Account\Users\Names\'
    TargetObject|endswith: '$\(Default)'
    Image|endswith: '\lsass.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\lsass.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"\lsass.exe"`
`TargetObject`	ends_with	`$\(Default)`	`field:"TargetObject" kind:ends_with value:"$\(Default)"`
`TargetObject`	match	`\SAM\SAM\Domains\Account\Users\Names\`	`field:"TargetObject" kind:match value:"\SAM\SAM\Domains\Account\Users\Names\"`

Download From Suspicious TLD - Whitelist

Status: test
Severity: low
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects executable downloads from suspicious remote systems

Known False Positives

All kind of software downloads

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1566` Phishing
Execution	`T1203` Exploitation for Client Execution `T1204.002` User Execution: Malicious File

Rule Body

title: Download From Suspicious TLD - Whitelist
id: b5de2919-b74a-4805-91a7-5049accbaefe
related:
    - id: 00d0b5ab-1f55-4120-8e83-487c0a7baf19
      type: similar
status: test
description: Detects executable downloads from suspicious remote systems
references:
    - Internal Research
author: Florian Roth (Nextron Systems)
date: 2017-03-13
modified: 2023-05-18
tags:
    - attack.initial-access
    - attack.t1566
    - attack.execution
    - attack.t1203
    - attack.t1204.002
logsource:
    category: proxy
detection:
    selection:
        c-uri-extension:
            - 'exe'
            - 'vbs'
            - 'bat'
            - 'rar'
            - 'ps1'
            - 'doc'
            - 'docm'
            - 'xls'
            - 'xlsm'
            - 'pptm'
            - 'rtf'
            - 'hta'
            - 'dll'
            - 'ws'
            - 'wsf'
            - 'sct'
            - 'zip'
            # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/
    filter:
        cs-host|endswith:
            - '.com'
            - '.org'
            - '.net'
            - '.edu'
            - '.gov'
            - '.uk'
            - '.ca'
            - '.de'
            - '.jp'
            - '.fr'
            - '.au'
            - '.us'
            - '.ch'
            - '.it'
            - '.nl'
            - '.se'
            - '.no'
            - '.es'
            # Extend this list as needed
    condition: selection and not filter
falsepositives:
    - All kind of software downloads
level: low

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    c-uri-extension:
        - 'exe'
        - 'vbs'
        - 'bat'
        - 'rar'
        - 'ps1'
        - 'doc'
        - 'docm'
        - 'xls'
        - 'xlsm'
        - 'pptm'
        - 'rtf'
        - 'hta'
        - 'dll'
        - 'ws'
        - 'wsf'
        - 'sct'
        - 'zip'

Stage 2: `not filter`

filter:
    cs-host|endswith:
        - '.com'
        - '.org'
        - '.net'
        - '.edu'
        - '.gov'
        - '.uk'
        - '.ca'
        - '.de'
        - '.jp'
        - '.fr'
        - '.au'
        - '.us'
        - '.ch'
        - '.it'
        - '.nl'
        - '.se'
        - '.no'
        - '.es'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`c-uri-extension`	eq	`bat` `dll` `doc` `docm` `exe` `hta` `pptm` `ps1` `rar` `rtf` `sct` `vbs` `ws` `wsf` `xls` `xlsm` `zip`	`field:"c-uri-extension" kind:eq`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`cs-host`	ends_with	`.au`	`excludes:cs-host` `field:"cs-host" value:".au"`
`cs-host`	ends_with	`.ca`	`excludes:cs-host` `field:"cs-host" value:".ca"`
`cs-host`	ends_with	`.ch`	`excludes:cs-host` `field:"cs-host" value:".ch"`
`cs-host`	ends_with	`.com`	`excludes:cs-host` `field:"cs-host" value:".com"`
`cs-host`	ends_with	`.de`	`excludes:cs-host` `field:"cs-host" value:".de"`
`cs-host`	ends_with	`.edu`	`excludes:cs-host` `field:"cs-host" value:".edu"`
`cs-host`	ends_with	`.es`	`excludes:cs-host` `field:"cs-host" value:".es"`
`cs-host`	ends_with	`.fr`	`excludes:cs-host` `field:"cs-host" value:".fr"`
`cs-host`	ends_with	`.gov`	`excludes:cs-host` `field:"cs-host" value:".gov"`
`cs-host`	ends_with	`.it`	`excludes:cs-host` `field:"cs-host" value:".it"`
`cs-host`	ends_with	`.jp`	`excludes:cs-host` `field:"cs-host" value:".jp"`
`cs-host`	ends_with	`.net`	`excludes:cs-host` `field:"cs-host" value:".net"`
`cs-host`	ends_with	`.nl`	`excludes:cs-host` `field:"cs-host" value:".nl"`
`cs-host`	ends_with	`.no`	`excludes:cs-host` `field:"cs-host" value:".no"`
`cs-host`	ends_with	`.org`	`excludes:cs-host` `field:"cs-host" value:".org"`
`cs-host`	ends_with	`.se`	`excludes:cs-host` `field:"cs-host" value:".se"`
`cs-host`	ends_with	`.uk`	`excludes:cs-host` `field:"cs-host" value:".uk"`
`cs-host`	ends_with	`.us`	`excludes:cs-host` `field:"cs-host" value:".us"`

File In Suspicious Location Encoded To Base64 Via Certutil.EXE

Status: test
Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	`T1027` Obfuscated Files or Information

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: File In Suspicious Location Encoded To Base64 Via Certutil.EXE
id: 82a6714f-4899-4f16-9c1e-9a333544d4c3
related:
    - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
      type: derived
status: test
description: Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations
references:
    - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior
    - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior
    - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior
    - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-15
modified: 2024-03-05
tags:
    - attack.stealth
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_cli:
        CommandLine|contains|windash: '-encode'
    selection_extension:
        CommandLine|contains:
            # Note: Add more suspicious locations to increase coverage
            - '\AppData\Roaming\'
            - '\Desktop\'
            - '\Local\Temp\'
            - '\PerfLogs\'
            - '\Users\Public\'
            - '\Windows\Temp\'
            - '$Recycle.Bin'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\certutil.exe'
    - OriginalFileName: 'CertUtil.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|windash: '-encode'

Stage 3: `selection_extension`

selection_extension:
    CommandLine|contains:
        - '\AppData\Roaming\'
        - '\Desktop\'
        - '\Local\Temp\'
        - '\PerfLogs\'
        - '\Users\Public\'
        - '\Windows\Temp\'
        - '$Recycle.Bin'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`$Recycle.Bin` `-encode` corpus 3 (sigma 3) `/encode` corpus 3 (sigma 3) `\AppData\Roaming\` corpus 17 (sigma 16, elastic 1) `\Desktop\` corpus 13 (sigma 13) `\Local\Temp\` corpus 2 (sigma 2) `\PerfLogs\` corpus 3 (sigma 3) `\Users\Public\` corpus 18 (sigma 17, elastic 1) `\Windows\Temp\` corpus 13 (sigma 12, elastic 1) `–encode` corpus 3 (sigma 3) `—encode` corpus 3 (sigma 3) `―encode` corpus 3 (sigma 3)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\certutil.exe` corpus 43 (sigma 43)	`field:"Image" kind:ends_with value:"\certutil.exe"`
`OriginalFileName`	eq	`CertUtil.exe` corpus 26 (sigma 14, elastic 6, splunk 6)	`field:"OriginalFileName" kind:eq value:"CertUtil.exe"`

Kubernetes Rolebinding Modification

Status: test
Severity: medium
Author: kelnage
Source: github.com/SigmaHQ/sigma

Detects when a Kubernetes Rolebinding is created or modified.

Known False Positives

Modifying a Kubernetes Rolebinding may need to be done by a system administrator.
Automated processes may need to take these actions and may need to be filtered.

MITRE ATT&CK Coverage

Tactic	Techniques
Privilege Escalation	No specific technique

Telemetry Coverage

Platform	Record / event type
Kubernetes	create-clusterrolebindings: create clusterrolebindings
Kubernetes	update-clusterrolebindings: update clusterrolebindings
Kubernetes	patch-clusterrolebindings: patch clusterrolebindings
Kubernetes	delete-clusterrolebindings: delete clusterrolebindings
Kubernetes	create-rolebindings: create rolebindings
Kubernetes	update-rolebindings: update rolebindings
Kubernetes	patch-rolebindings: patch rolebindings
Kubernetes	delete-rolebindings: delete rolebindings

Rules Detecting the Same Action

These rules filter on the same operation.

Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
GKE Cluster-Admin Role Binding Created or Modified (Elastic)
GKE Creation of a RoleBinding Referencing a ServiceAccount (Elastic)
GKE Service Account Modified RBAC Objects (Elastic)
Google Cloud Kubernetes RoleBinding (Sigma)
Kubernetes Cluster-Admin Role Binding Created (Elastic)
Kubernetes ClusterRoleBinding to Privileged Role (Panther)
Kubernetes Creation of a RoleBinding Referencing a ServiceAccount (Elastic)

Rule Body

title: Kubernetes Rolebinding Modification
id: 10b97915-ec8d-455f-a815-9a78926585f6
related:
    - id: 0322d9f2-289a-47c2-b5e1-b63c90901a3e
      type: similar
status: test
description: |
    Detects when a Kubernetes Rolebinding is created or modified.
references:
    - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
    - https://medium.com/@seifeddinerajhi/kubernetes-rbac-privilege-escalation-exploits-and-mitigations-26c07629eeab
author: kelnage
date: 2024-07-11
tags:
    - attack.privilege-escalation
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        objectRef.apiGroup: 'rbac.authorization.k8s.io'
        objectRef.resource:
            - 'clusterrolebindings'
            - 'rolebindings'
        verb:
            - 'create'
            - 'delete'
            - 'patch'
            - 'replace'
            - 'update'
    condition: selection
falsepositives:
    - Modifying a Kubernetes Rolebinding may need to be done by a system administrator.
    - Automated processes may need to take these actions and may need to be filtered.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    objectRef.apiGroup: 'rbac.authorization.k8s.io'
    objectRef.resource:
        - 'clusterrolebindings'
        - 'rolebindings'
    verb:
        - 'create'
        - 'delete'
        - 'patch'
        - 'replace'
        - 'update'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`objectRef.apiGroup`	eq	`rbac.authorization.k8s.io`	`field:"objectRef.apiGroup" kind:eq value:"rbac.authorization.k8s.io"`
`objectRef.resource`	eq	`clusterrolebindings` `rolebindings`	`field:"objectRef.resource" kind:eq`
`verb`	eq	`create` corpus 23 (sigma 10, splunk 7, panther 6) `delete` corpus 6 (sigma 6) `patch` corpus 5 (sigma 5) `replace` corpus 4 (sigma 4) `update` corpus 6 (sigma 4, splunk 2)	`field:"verb" kind:eq`

Log4j RCE CVE-2021-44228 in Fields

Status: test
Severity: high
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

Known False Positives

Vulnerability scanning

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule Body

title: Log4j RCE CVE-2021-44228 in Fields
id: 9be472ed-893c-4ec0-94da-312d2765f654
status: test
description: Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)
references:
    - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
    - https://news.ycombinator.com/item?id=29504755
    - https://github.com/tangxiaofeng7/apache-log4j-poc
    - https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
    - https://github.com/YfryTchsGD/Log4jAttackSurface
    - https://twitter.com/shutingrz/status/1469255861394866177?s=21
author: Florian Roth (Nextron Systems)
date: 2021-12-10
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2021-44228
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection1:
        cs-user-agent|contains:
            - '${jndi:ldap:/'
            - '${jndi:rmi:/'
            - '${jndi:ldaps:/'
            - '${jndi:dns:/'
            - '/$%7bjndi:'
            - '%24%7bjndi:'
            - '$%7Bjndi:'
            - '%2524%257Bjndi'
            - '%2F%252524%25257Bjndi%3A'
            - '${jndi:${lower:'
            - '${::-j}${'
            - '${jndi:nis'
            - '${jndi:nds'
            - '${jndi:corba'
            - '${jndi:iiop'
            - 'Reference Class Name: foo'
            - '${${env:BARFOO:-j}'
            - '${::-l}${::-d}${::-a}${::-p}'
            - '${base64:JHtqbmRp'
            - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            - '${${lower:j}ndi:'
            - '${${upper:j}ndi:'
            - '${${::-j}${::-n}${::-d}${::-i}:'
    # selection2:
        # user-agent|contains:
            # - '${jndi:ldap:/'
            # - '${jndi:rmi:/'
            # - '${jndi:ldaps:/'
            # - '${jndi:dns:/'
            # - '/$%7bjndi:'
            # - '%24%7bjndi:'
            # - '$%7Bjndi:'
            # - '%2524%257Bjndi'
            # - '%2F%252524%25257Bjndi%3A'
            # - '${jndi:${lower:'
            # - '${::-j}${'
            # - '${jndi:nis'
            # - '${jndi:nds'
            # - '${jndi:corba'
            # - '${jndi:iiop'
            # - 'Reference Class Name: foo'
            # - '${${env:BARFOO:-j}'
            # - '${::-l}${::-d}${::-a}${::-p}'
            # - '${base64:JHtqbmRp'
            # - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            # - '${${lower:j}ndi:'
            # - '${${upper:j}ndi:'
            # - '${${::-j}${::-n}${::-d}${::-i}:'
    selection3:
        cs-uri-query|contains:
            - '${jndi:ldap:/'
            - '${jndi:rmi:/'
            - '${jndi:ldaps:/'
            - '${jndi:dns:/'
            - '/$%7bjndi:'
            - '%24%7bjndi:'
            - '$%7Bjndi:'
            - '%2524%257Bjndi'
            - '%2F%252524%25257Bjndi%3A'
            - '${jndi:${lower:'
            - '${::-j}${'
            - '${jndi:nis'
            - '${jndi:nds'
            - '${jndi:corba'
            - '${jndi:iiop'
            - 'Reference Class Name: foo'
            - '${${env:BARFOO:-j}'
            - '${::-l}${::-d}${::-a}${::-p}'
            - '${base64:JHtqbmRp'
            - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            - '${${lower:j}ndi:'
            - '${${upper:j}ndi:'
            - '${${::-j}${::-n}${::-d}${::-i}:'
    selection4:
        cs-referer|contains:
            - '${jndi:ldap:/'
            - '${jndi:rmi:/'
            - '${jndi:ldaps:/'
            - '${jndi:dns:/'
            - '/$%7bjndi:'
            - '%24%7bjndi:'
            - '$%7Bjndi:'
            - '%2524%257Bjndi'
            - '%2F%252524%25257Bjndi%3A'
            - '${jndi:${lower:'
            - '${::-j}${'
            - '${jndi:nis'
            - '${jndi:nds'
            - '${jndi:corba'
            - '${jndi:iiop'
            - 'Reference Class Name: foo'
            - '${${env:BARFOO:-j}'
            - '${::-l}${::-d}${::-a}${::-p}'
            - '${base64:JHtqbmRp'
            - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            - '${${lower:j}ndi:'
            - '${${upper:j}ndi:'
            - '${${::-j}${::-n}${::-d}${::-i}:'
    condition: 1 of selection*
falsepositives:
    - Vulnerability scanning
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection1`

selection1:
    cs-user-agent|contains:
        - '${jndi:ldap:/'
        - '${jndi:rmi:/'
        - '${jndi:ldaps:/'
        - '${jndi:dns:/'
        - '/$%7bjndi:'
        - '%24%7bjndi:'
        - '$%7Bjndi:'
        - '%2524%257Bjndi'
        - '%2F%252524%25257Bjndi%3A'
        - '${jndi:${lower:'
        - '${::-j}${'
        - '${jndi:nis'
        - '${jndi:nds'
        - '${jndi:corba'
        - '${jndi:iiop'
        - 'Reference Class Name: foo'
        - '${${env:BARFOO:-j}'
        - '${::-l}${::-d}${::-a}${::-p}'
        - '${base64:JHtqbmRp'
        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
        - '${${lower:j}ndi:'
        - '${${upper:j}ndi:'
        - '${${::-j}${::-n}${::-d}${::-i}:'

Stage 2: `selection3`

selection3:
    cs-uri-query|contains:
        - '${jndi:ldap:/'
        - '${jndi:rmi:/'
        - '${jndi:ldaps:/'
        - '${jndi:dns:/'
        - '/$%7bjndi:'
        - '%24%7bjndi:'
        - '$%7Bjndi:'
        - '%2524%257Bjndi'
        - '%2F%252524%25257Bjndi%3A'
        - '${jndi:${lower:'
        - '${::-j}${'
        - '${jndi:nis'
        - '${jndi:nds'
        - '${jndi:corba'
        - '${jndi:iiop'
        - 'Reference Class Name: foo'
        - '${${env:BARFOO:-j}'
        - '${::-l}${::-d}${::-a}${::-p}'
        - '${base64:JHtqbmRp'
        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
        - '${${lower:j}ndi:'
        - '${${upper:j}ndi:'
        - '${${::-j}${::-n}${::-d}${::-i}:'

Stage 3: `selection4`

selection4:
    cs-referer|contains:
        - '${jndi:ldap:/'
        - '${jndi:rmi:/'
        - '${jndi:ldaps:/'
        - '${jndi:dns:/'
        - '/$%7bjndi:'
        - '%24%7bjndi:'
        - '$%7Bjndi:'
        - '%2524%257Bjndi'
        - '%2F%252524%25257Bjndi%3A'
        - '${jndi:${lower:'
        - '${::-j}${'
        - '${jndi:nis'
        - '${jndi:nds'
        - '${jndi:corba'
        - '${jndi:iiop'
        - 'Reference Class Name: foo'
        - '${${env:BARFOO:-j}'
        - '${::-l}${::-d}${::-a}${::-p}'
        - '${base64:JHtqbmRp'
        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
        - '${${lower:j}ndi:'
        - '${${upper:j}ndi:'
        - '${${::-j}${::-n}${::-d}${::-i}:'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-referer`	match	`$%7Bjndi:` `${${::-j}${::-n}${::-d}${::-i}:` `${${env:BARFOO:-j}` `${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$` `${${lower:j}ndi:` `${${upper:j}ndi:` `${::-j}${` `${::-l}${::-d}${::-a}${::-p}` `${base64:JHtqbmRp` `${jndi:${lower:` `${jndi:corba` `${jndi:dns:/` `${jndi:iiop` `${jndi:ldap:/` `${jndi:ldaps:/` `${jndi:nds` `${jndi:nis` `${jndi:rmi:/` `%24%7bjndi:` `%2524%257Bjndi` `%2F%252524%25257Bjndi%3A` `/$%7bjndi:` `Reference Class Name: foo`	`field:"cs-referer" kind:match`
`cs-uri-query`	match	`$%7Bjndi:` `${${::-j}${::-n}${::-d}${::-i}:` `${${env:BARFOO:-j}` `${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$` `${${lower:j}ndi:` `${${upper:j}ndi:` `${::-j}${` `${::-l}${::-d}${::-a}${::-p}` `${base64:JHtqbmRp` `${jndi:${lower:` `${jndi:corba` `${jndi:dns:/` `${jndi:iiop` `${jndi:ldap:/` `${jndi:ldaps:/` `${jndi:nds` `${jndi:nis` `${jndi:rmi:/` `%24%7bjndi:` `%2524%257Bjndi` `%2F%252524%25257Bjndi%3A` `/$%7bjndi:` `Reference Class Name: foo`	`field:"cs-uri-query" kind:match`
`cs-user-agent`	match	`$%7Bjndi:` `${${::-j}${::-n}${::-d}${::-i}:` `${${env:BARFOO:-j}` `${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$` `${${lower:j}ndi:` `${${upper:j}ndi:` `${::-j}${` `${::-l}${::-d}${::-a}${::-p}` `${base64:JHtqbmRp` `${jndi:${lower:` `${jndi:corba` `${jndi:dns:/` `${jndi:iiop` `${jndi:ldap:/` `${jndi:ldaps:/` `${jndi:nds` `${jndi:nis` `${jndi:rmi:/` `%24%7bjndi:` `%2524%257Bjndi` `%2F%252524%25257Bjndi%3A` `/$%7bjndi:` `Reference Class Name: foo`	`field:"cs-user-agent" kind:match`

Msiexec Quiet Installation

Status: test
Severity: medium
Author: frack113
Source: github.com/SigmaHQ/sigma

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)

Known False Positives

WindowsApps installing updates via the quiet flag

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	`T1218.007` System Binary Proxy Execution: Msiexec

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Msiexec Quiet Installation
id: 79a87aa6-e4bd-42fc-a5bb-5e6fbdcd62f5
status: test
description: |
    Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
    Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
    - https://twitter.com/_st0pp3r_/status/1583914244344799235
author: frack113
date: 2022-01-16
modified: 2026-07-28
tags:
    - attack.stealth
    - attack.t1218.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\msiexec.exe'
        - OriginalFileName: 'msiexec.exe'
    selection_cli:
        # Note that there is no space before and after the arguments because it's possible to write a commandline as such
        # Example: msiexec -q/i [MSI Package]
        CommandLine|contains|windash:
            - '-i'
            - '-package'
            - '-a'
            - '-j'
    selection_quiet:
        CommandLine|contains|windash: '-q'
    filter_main_system_temp:
        ParentImage|startswith: 'C:\Windows\Temp\'
    filter_main_ccm:
        ParentImage: 'C:\Windows\CCM\Ccm32BitLauncher.exe'
        IntegrityLevel:
            - 'System'
            - 'S-1-16-16384'
    filter_optional_user_temp:
        # The %temp% is a very common location for installers
        ParentImage|startswith: 'C:\Users\'
        ParentImage|contains: '\AppData\Local\Temp\'
    filter_optional_wsl:
        # C:\WINDOWS\system32\msiexec.exe /quiet /i "C:\Users\xodih\AppData\Local\Temp\wsl.2.6.3.0.arm64 (2).msi" SKIPVALIDATION=1 /L*V C:\Users\xodih\AppData\Local\Temp\wsl-install-logs.txt
        ParentImage|endswith: 'C:\Windows\System32\wsl.exe'
        Image|endswith: 'C:\Windows\System32\msiexec.exe'
    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - WindowsApps installing updates via the quiet flag
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\msiexec.exe'
    - OriginalFileName: 'msiexec.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|windash:
        - '-i'
        - '-package'
        - '-a'
        - '-j'

Stage 3: `selection_quiet`

selection_quiet:
    CommandLine|contains|windash: '-q'

Stage 4: `not filter_main_*`

filter_main_system_temp:
    ParentImage|startswith: 'C:\Windows\Temp\'
filter_main_ccm:
    ParentImage: 'C:\Windows\CCM\Ccm32BitLauncher.exe'
    IntegrityLevel:
        - 'System'
        - 'S-1-16-16384'

Stage 5: `not filter_optional_*`

filter_optional_user_temp:
    ParentImage|startswith: 'C:\Users\'
    ParentImage|contains: '\AppData\Local\Temp\'
filter_optional_wsl:
    ParentImage|endswith: 'C:\Windows\System32\wsl.exe'
    Image|endswith: 'C:\Windows\System32\msiexec.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-a` corpus 7 (sigma 6, splunk 1) `-i` corpus 7 (sigma 7) `-j` corpus 2 (sigma 2) `-package` corpus 2 (sigma 2) `-q` corpus 8 (sigma 7, splunk 1) `/a` corpus 3 (sigma 3) `/i` corpus 4 (sigma 4) `/j` corpus 3 (sigma 3) `/package` corpus 2 (sigma 2) `/q` corpus 10 (sigma 9, splunk 1) `–a` corpus 3 (sigma 3) `–i` corpus 2 (sigma 2) `–j` corpus 2 (sigma 2) `–package` corpus 2 (sigma 2) `–q` corpus 3 (sigma 3) `—a` corpus 3 (sigma 3) `—i` corpus 2 (sigma 2) `—j` corpus 2 (sigma 2) `—package` corpus 2 (sigma 2) `—q` corpus 3 (sigma 3) `―a` corpus 3 (sigma 3) `―i` corpus 2 (sigma 2) `―j` corpus 2 (sigma 2) `―package` corpus 2 (sigma 2) `―q` corpus 3 (sigma 3)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\msiexec.exe` corpus 20 (sigma 20)	`field:"Image" kind:ends_with value:"\msiexec.exe"`
`OriginalFileName`	eq	`msiexec.exe` corpus 18 (elastic 9, sigma 5, splunk 4)	`field:"OriginalFileName" kind:eq value:"msiexec.exe"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`IntegrityLevel`	eq	`S-1-16-16384`	`excludes:IntegrityLevel` `field:"IntegrityLevel" value:"S-1-16-16384"`
`IntegrityLevel`	eq	`System`	`excludes:IntegrityLevel` `field:"IntegrityLevel" value:"System"`
`ParentImage`	eq	`C:\Windows\CCM\Ccm32BitLauncher.exe`	`excludes:ParentImage` `field:"ParentImage" value:"C:\Windows\CCM\Ccm32BitLauncher.exe"`
`ParentImage`	starts_with	`C:\Windows\Temp\`	`excludes:ParentImage` `field:"ParentImage" value:"C:\Windows\Temp\"`
`Image`	ends_with	`C:\Windows\System32\msiexec.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\msiexec.exe"`
`ParentImage`	ends_with	`C:\Windows\System32\wsl.exe`	`excludes:ParentImage` `field:"ParentImage" value:"C:\Windows\System32\wsl.exe"`
`ParentImage`	match	`\AppData\Local\Temp\`	`excludes:ParentImage` `field:"ParentImage" value:"\AppData\Local\Temp\"`
`ParentImage`	starts_with	`C:\Users\`	`excludes:ParentImage` `field:"ParentImage" value:"C:\Users\"`

Network Connection Initiated To DevTunnels Domain

Status: test
Severity: medium
Author: Kamran Saifullah
Source: github.com/SigmaHQ/sigma

Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Known False Positives

Legitimate use of Devtunnels will also trigger this.

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1572` Protocol Tunneling
Exfiltration	`T1567.001` Exfiltration Over Web Service: Exfiltration to Code Repository

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 3: Network connection

Rule Body

title: Network Connection Initiated To DevTunnels Domain
id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
related:
    - id: 4b657234-038e-4ad5-997c-4be42340bce4 # Net Connection VsCode
      type: similar
    - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 # DNS VsCode
      type: similar
    - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b # DNS DevTunnels
      type: similar
status: test
description: |
    Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
references:
    - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
    - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
    - https://cydefops.com/devtunnels-unleashed
author: Kamran Saifullah
date: 2023-11-20
tags:
    - attack.exfiltration
    - attack.command-and-control
    - attack.t1567.001
    - attack.t1572
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|endswith: '.devtunnels.ms'
    condition: selection
falsepositives:
    - Legitimate use of Devtunnels will also trigger this.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Initiated: 'true'
    DestinationHostname|endswith: '.devtunnels.ms'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DestinationHostname`	ends_with	`.devtunnels.ms`	`field:"DestinationHostname" kind:ends_with value:".devtunnels.ms"`
`Initiated`	eq	`true` corpus 50 (sigma 50)	`field:"Initiated" kind:eq value:"true"`

Nslookup PowerShell Download Cradle

Status: test
Severity: medium
Author: Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam
Source: github.com/SigmaHQ/sigma

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry Coverage

Provider	Record / event type
PowerShell	Event ID 400

Rule Body

title: Nslookup PowerShell Download Cradle
id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1
related:
    - id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23
      type: similar
status: test
description: Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
references:
    - https://twitter.com/Alh4zr3d/status/1566489367232651264
author: Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam
date: 2022-12-10
modified: 2025-02-25
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection:
        Data|contains|all:
            - 'powershell'
            - 'nslookup'
            - '[1]'
        Data|contains:
            - '-q=txt http'
            - '-querytype=txt http'
            - '-type=txt http'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Data|contains|all:
        - 'powershell'
        - 'nslookup'
        - '[1]'
    Data|contains:
        - '-q=txt http'
        - '-querytype=txt http'
        - '-type=txt http'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Data`	match	`-q=txt http` `-querytype=txt http` `-type=txt http` `[1]` `nslookup` `powershell`	`field:"Data" kind:match`

Php Inline Command Execution

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Php Inline Command Execution
id: d81871ef-5738-47ab-9797-7a9c90cd4bfb
status: test
description: Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
references:
    - https://www.php.net/manual/en/features.commandline.php
    - https://www.revshells.com/
    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-02
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\php.exe'
        - OriginalFileName: 'php.exe'
    selection_cli:
        CommandLine|contains: ' -r'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\php.exe'
    - OriginalFileName: 'php.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: ' -r'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-r` corpus 4 (sigma 3, splunk 1)	`field:"CommandLine" kind:match value:" -r"`
`Image`	ends_with	`\php.exe`	`field:"Image" kind:ends_with value:"\php.exe"`
`OriginalFileName`	eq	`php.exe`	`field:"OriginalFileName" kind:eq value:"php.exe"`

Potential appverifUI.DLL Sideloading

Status: test
Severity: high
Author: X__Junior (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potential DLL sideloading of "appverifUI.dll"

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1574.001` Hijack Execution Flow: DLL
Stealth	`T1574.001` Hijack Execution Flow: DLL

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule Body

title: Potential appverifUI.DLL Sideloading
id: ee6cea48-c5b6-4304-a332-10fc6446f484
status: test
description: Detects potential DLL sideloading of "appverifUI.dll"
references:
    - https://web.archive.org/web/20220519091349/https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/
author: X__Junior (Nextron Systems)
date: 2023-06-20
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\appverifUI.dll'
    filter_main_legit_path:
        Image:
            - 'C:\Windows\SysWOW64\appverif.exe'
            - 'C:\Windows\System32\appverif.exe'
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    ImageLoaded|endswith: '\appverifUI.dll'

Stage 2: `not filter_main_legit_path`

filter_main_legit_path:
    Image:
        - 'C:\Windows\SysWOW64\appverif.exe'
        - 'C:\Windows\System32\appverif.exe'
    ImageLoaded|startswith:
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ImageLoaded`	ends_with	`\appverifUI.dll`	`field:"ImageLoaded" kind:ends_with value:"\appverifUI.dll"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`C:\Windows\SysWOW64\appverif.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\appverif.exe"`
`Image`	eq	`C:\Windows\System32\appverif.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\appverif.exe"`
`ImageLoaded`	starts_with	`C:\Windows\SysWOW64\`	`excludes:ImageLoaded` `field:"ImageLoaded" value:"C:\Windows\SysWOW64\"`
`ImageLoaded`	starts_with	`C:\Windows\System32\`	`excludes:ImageLoaded` `field:"ImageLoaded" value:"C:\Windows\System32\"`
`ImageLoaded`	starts_with	`C:\Windows\WinSxS\`	`excludes:ImageLoaded` `field:"ImageLoaded" value:"C:\Windows\WinSxS\"`

Potential Discovery Activity Using Find - MacOS

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects usage of "find" binary in a suspicious manner to perform discovery

MITRE ATT&CK Coverage

Tactic	Techniques
Discovery	`T1083` File and Directory Discovery

Telemetry Coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule Body

title: Potential Discovery Activity Using Find - MacOS
id: 85de3a19-b675-4a51-bfc6-b11a5186c971
related:
    - id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
      type: similar
status: test
description: Detects usage of "find" binary in a suspicious manner to perform discovery
references:
    - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-28
tags:
    - attack.discovery
    - attack.t1083
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/find'
        CommandLine|contains:
            - '-perm -4000'
            - '-perm -2000'
            - '-perm 0777'
            - '-perm -222'
            - '-perm -o w'
            - '-perm -o x'
            - '-perm -u=s'
            - '-perm -g=s'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '/find'
    CommandLine|contains:
        - '-perm -4000'
        - '-perm -2000'
        - '-perm 0777'
        - '-perm -222'
        - '-perm -o w'
        - '-perm -o x'
        - '-perm -u=s'
        - '-perm -g=s'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-perm -2000` corpus 2 (sigma 2) `-perm -222` corpus 2 (sigma 2) `-perm -4000` corpus 2 (sigma 2) `-perm -g=s` corpus 2 (sigma 2) `-perm -o w` corpus 2 (sigma 2) `-perm -o x` corpus 2 (sigma 2) `-perm -u=s` corpus 2 (sigma 2) `-perm 0777` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`/find` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"/find"`

Potential KamiKakaBot Activity - Lure Document Execution

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Potential KamiKakaBot Activity - Lure Document Execution
id: 24474469-bd80-46cc-9e08-9fbe81bfaaca
status: test
description: |
    Detects the execution of a Word document via the WinWord Start Menu shortcut.
    This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.
references:
    - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
date: 2024-03-22
tags:
    - attack.execution
    - attack.t1059
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - '/c '
            - '.lnk ~'
            - 'Start Menu\Programs\Word'
        CommandLine|endswith: '.doc'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:
        - '/c '
        - '.lnk ~'
        - 'Start Menu\Programs\Word'
    CommandLine|endswith: '.doc'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`.doc`	`field:"CommandLine" kind:ends_with value:".doc"`
`CommandLine`	match	`.lnk ~` `/c` corpus 4 (sigma 4) `Start Menu\Programs\Word`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmd.exe` corpus 132 (sigma 130, splunk 2)	`field:"Image" kind:ends_with value:"\cmd.exe"`

Potential Webshell Creation On Static Website

Status: test
Severity: medium
Author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo
Source: github.com/SigmaHQ/sigma

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Known False Positives

Legitimate administrator or developer creating legitimate executable files in a web application folder

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule Body

title: Potential Webshell Creation On Static Website
id: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
status: test
description: Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
references:
    - PT ESC rule and personal experience
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md
author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo
date: 2019-10-22
modified: 2023-10-15
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    product: windows
    category: file_event
detection:
    selection_wwwroot_path:
        TargetFilename|contains: '\inetpub\wwwroot\'
    selection_wwwroot_ext:
        TargetFilename|contains:
            - '.ashx'
            - '.asp'
            - '.ph'
            - '.soap'
    selection_htdocs_path:
        TargetFilename|contains:
            - '\www\'
            - '\htdocs\'
            - '\html\'
    selection_htdocs_ext:
        TargetFilename|contains: '.ph'
    # selection_tomcat_path:
    #     TargetFilename|contains: '\webapps\ROOT'
    # selection_tomcat_ext:
    #     TargetFilename|contains:
    #         - '.jsp' # .jspx, .jspf
    #         - '.jsv'
    #         - '.jsw'
    filter_main_temp:  # FP when unpacking some executables in $TEMP
        TargetFilename|contains:
            - '\AppData\Local\Temp\'
            - '\Windows\Temp\'
    filter_main_system:
        Image: 'System' # FP when backup/restore from drivers
    filter_main_legitimate:
        TargetFilename|contains: '\xampp'
    condition: (all of selection_wwwroot_* or all of selection_htdocs_*) and not 1 of filter_main_*
falsepositives:
    - Legitimate administrator or developer creating legitimate executable files in a web application folder
level: medium

Stages and Predicates

Stage 0: `condition`

(all of selection_wwwroot_* or all of selection_htdocs_*) and not 1 of filter_main_*

Stage 1: `selection_wwwroot_path`

selection_wwwroot_path:
    TargetFilename|contains: '\inetpub\wwwroot\'

Stage 2: `selection_wwwroot_ext`

selection_wwwroot_ext:
    TargetFilename|contains:
        - '.ashx'
        - '.asp'
        - '.ph'
        - '.soap'

Stage 3: `selection_htdocs_path`

selection_htdocs_path:
    TargetFilename|contains:
        - '\www\'
        - '\htdocs\'
        - '\html\'

Stage 4: `selection_htdocs_ext`

selection_htdocs_ext:
    TargetFilename|contains: '.ph'

Stage 5: `not filter_main_*`

filter_main_temp:
    TargetFilename|contains:
        - '\AppData\Local\Temp\'
        - '\Windows\Temp\'
filter_main_system:
    Image: 'System'
filter_main_legitimate:
    TargetFilename|contains: '\xampp'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	match	`.ashx` `.asp` `.ph` `.soap` `\htdocs\` `\html\` `\inetpub\wwwroot\` corpus 2 (sigma 2) `\www\`	`field:"TargetFilename" kind:match`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`System`	`excludes:Image` `field:"Image" value:"System"`
`TargetFilename`	match	`\AppData\Local\Temp\`	`excludes:TargetFilename` `field:"TargetFilename" value:"\AppData\Local\Temp\"`
`TargetFilename`	match	`\Windows\Temp\`	`excludes:TargetFilename` `field:"TargetFilename" value:"\Windows\Temp\"`
`TargetFilename`	match	`\xampp`	`excludes:TargetFilename` `field:"TargetFilename" value:"\xampp"`

Potentially Suspicious Execution Of PDQDeployRunner

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines

Known False Positives

Legitimate use of the PDQDeploy tool to execute these commands

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Potentially Suspicious Execution Of PDQDeployRunner
id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184
related:
    - id: d679950c-abb7-43a6-80fb-2a480c4fc450
      type: similar
status: test
description: Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines
references:
    - https://twitter.com/malmoeb/status/1550483085472432128
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-22
modified: 2024-05-02
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: '\PDQDeployRunner-'
    selection_child:
        # Improve this section by adding other suspicious processes, commandlines or paths
        - Image|endswith:
              # If you use any of the following processes legitimately comment them out
              - '\bash.exe'
              - '\certutil.exe'
              - '\cmd.exe'
              - '\csc.exe'
              - '\cscript.exe'
              - '\dllhost.exe'
              - '\mshta.exe'
              - '\msiexec.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\scriptrunner.exe'
              - '\wmic.exe'
              - '\wscript.exe'
              - '\wsl.exe'
        - Image|contains:
              - ':\ProgramData\'
              - ':\Users\Public\'
              - ':\Windows\TEMP\'
              - '\AppData\Local\Temp'
        - CommandLine|contains:
              - ' -decode '
              - ' -enc '
              - ' -encodedcommand '
              - ' -w hidden'
              - 'DownloadString'
              - 'FromBase64String'
              - 'http'
              - 'iex '
              - 'Invoke-'
    condition: all of selection_*
falsepositives:
    - Legitimate use of the PDQDeploy tool to execute these commands
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|contains: '\PDQDeployRunner-'

Stage 2: `selection_child`

selection_child:
    - Image|endswith:
          - '\bash.exe'
          - '\certutil.exe'
          - '\cmd.exe'
          - '\csc.exe'
          - '\cscript.exe'
          - '\dllhost.exe'
          - '\mshta.exe'
          - '\msiexec.exe'
          - '\regsvr32.exe'
          - '\rundll32.exe'
          - '\scriptrunner.exe'
          - '\wmic.exe'
          - '\wscript.exe'
          - '\wsl.exe'
    - Image|contains:
          - ':\ProgramData\'
          - ':\Users\Public\'
          - ':\Windows\TEMP\'
          - '\AppData\Local\Temp'
    - CommandLine|contains:
          - ' -decode '
          - ' -enc '
          - ' -encodedcommand '
          - ' -w hidden'
          - 'DownloadString'
          - 'FromBase64String'
          - 'http'
          - 'iex '
          - 'Invoke-'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-decode` corpus 4 (sigma 4) `-enc` corpus 8 (sigma 6, elastic 2) `-encodedcommand` corpus 4 (sigma 2, elastic 2) `-w hidden` `DownloadString` corpus 8 (sigma 7, elastic 1) `FromBase64String` corpus 15 (sigma 9, elastic 4, splunk 2) `Invoke-` corpus 6 (sigma 6) `http` corpus 45 (sigma 34, elastic 10, splunk 1) `iex` corpus 7 (sigma 6, elastic 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\bash.exe` corpus 21 (sigma 21) `\certutil.exe` corpus 43 (sigma 43) `\cmd.exe` corpus 132 (sigma 130, splunk 2) `\csc.exe` corpus 9 (sigma 9) `\cscript.exe` corpus 72 (sigma 72) `\dllhost.exe` corpus 11 (sigma 11) `\mshta.exe` corpus 67 (sigma 66, splunk 1) `\msiexec.exe` corpus 20 (sigma 20) `\regsvr32.exe` corpus 64 (sigma 64) `\rundll32.exe` corpus 94 (sigma 94) `\scriptrunner.exe` corpus 12 (sigma 12) `\wmic.exe` corpus 62 (sigma 62) `\wscript.exe` corpus 74 (sigma 74) `\wsl.exe` corpus 11 (sigma 11)	`field:"Image" kind:ends_with`
`Image`	match	`:\ProgramData\` corpus 5 (sigma 3, elastic 1, splunk 1) `:\Users\Public\` corpus 13 (sigma 13) `:\Windows\TEMP\` corpus 8 (sigma 8) `\AppData\Local\Temp`	`field:"Image" kind:match`
`ParentImage`	match	`\PDQDeployRunner-`	`field:"ParentImage" kind:match value:"\PDQDeployRunner-"`

PSScriptPolicyTest Creation By Uncommon Process

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule Body

title: PSScriptPolicyTest Creation By Uncommon Process
id: 1027d292-dd87-4a1a-8701-2abe04d7783c
status: test
description: Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.
references:
    - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-01
modified: 2026-07-28
tags:
    - attack.stealth
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '__PSScriptPolicyTest_'
    filter_main_powershell:
        Image:
            - 'C:\Program Files\PowerShell\7-preview\pwsh.exe'
            - 'C:\Program Files\PowerShell\7\pwsh.exe'
            - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
            - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
            - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
            - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
    filter_main_pwsh_preview:
        Image|contains:
            - 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
            - '\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview'
        Image|endswith: '\pwsh.exe'
    filter_main_generic:
        Image:
            - 'C:\Windows\System32\dsac.exe'
            - 'C:\Windows\System32\sdiagnhost.exe'
            - 'C:\Windows\System32\ServerManager.exe'
            - 'C:\Windows\System32\wsmprovhost.exe'
            - 'C:\Windows\SysWOW64\sdiagnhost.exe'
    filter_optional_gethelp:
        Image|startswith: 'C:\Program Files\WindowsApps\Microsoft.GetHelp_'
        Image|endswith: '\GetHelp.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    TargetFilename|contains: '__PSScriptPolicyTest_'

Stage 2: `not filter_main_*`

filter_main_powershell:
    Image:
        - 'C:\Program Files\PowerShell\7-preview\pwsh.exe'
        - 'C:\Program Files\PowerShell\7\pwsh.exe'
        - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
        - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
        - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
filter_main_pwsh_preview:
    Image|contains:
        - 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
        - '\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview'
    Image|endswith: '\pwsh.exe'
filter_main_generic:
    Image:
        - 'C:\Windows\System32\dsac.exe'
        - 'C:\Windows\System32\sdiagnhost.exe'
        - 'C:\Windows\System32\ServerManager.exe'
        - 'C:\Windows\System32\wsmprovhost.exe'
        - 'C:\Windows\SysWOW64\sdiagnhost.exe'

Stage 3: `not filter_optional_gethelp`

filter_optional_gethelp:
    Image|startswith: 'C:\Program Files\WindowsApps\Microsoft.GetHelp_'
    Image|endswith: '\GetHelp.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	match	`__PSScriptPolicyTest_`	`field:"TargetFilename" kind:match value:"__PSScriptPolicyTest_"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	match	`C:\Program Files\WindowsApps\Microsoft.PowerShellPreview`	`excludes:Image` `field:"Image" value:"C:\Program Files\WindowsApps\Microsoft.PowerShellPreview"`
`Image`	match	`\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview`	`excludes:Image` `field:"Image" value:"\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview"`
`Image`	ends_with	`\pwsh.exe`	`excludes:Image` `field:"Image" value:"\pwsh.exe"`
`Image`	eq	`C:\Program Files\PowerShell\7-preview\pwsh.exe`	`excludes:Image` `field:"Image" value:"C:\Program Files\PowerShell\7-preview\pwsh.exe"`
`Image`	eq	`C:\Program Files\PowerShell\7\pwsh.exe`	`excludes:Image` `field:"Image" value:"C:\Program Files\PowerShell\7\pwsh.exe"`
`Image`	eq	`C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"`
`Image`	eq	`C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe"`
`Image`	eq	`C:\Windows\SysWOW64\sdiagnhost.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\sdiagnhost.exe"`
`Image`	eq	`C:\Windows\System32\ServerManager.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\ServerManager.exe"`
`Image`	eq	`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"`
`Image`	eq	`C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe"`
`Image`	eq	`C:\Windows\System32\dsac.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\dsac.exe"`
`Image`	eq	`C:\Windows\System32\sdiagnhost.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\sdiagnhost.exe"`
`Image`	eq	`C:\Windows\System32\wsmprovhost.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\wsmprovhost.exe"`
`Image`	ends_with	`\GetHelp.exe`	`excludes:Image` `field:"Image" value:"\GetHelp.exe"`
`Image`	starts_with	`C:\Program Files\WindowsApps\Microsoft.GetHelp_`	`excludes:Image` `field:"Image" value:"C:\Program Files\WindowsApps\Microsoft.GetHelp_"`

Recon Information for Export with Command Prompt

Status: test
Severity: medium
Author: frack113
Source: github.com/SigmaHQ/sigma

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

MITRE ATT&CK Coverage

Tactic	Techniques
Collection	`T1119` Automated Collection

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Recon Information for Export with Command Prompt
id: aa2efee7-34dd-446e-8a37-40790a66efd7
related:
    - id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892
      type: similar
status: test
description: Once established within a system or network, an adversary may use automated techniques for collecting internal data.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
author: frack113
date: 2021-07-30
modified: 2022-09-13
tags:
    - attack.collection
    - attack.t1119
logsource:
    product: windows
    category: process_creation
detection:
    selection_image:
        - Image|endswith:
              - '\tree.com'
              - '\WMIC.exe'
              - '\doskey.exe'
              - '\sc.exe'
        - OriginalFileName:
              - 'wmic.exe'
              - 'DOSKEY.EXE'
              - 'sc.exe'
    selection_redirect:
        ParentCommandLine|contains:
            - ' > %TEMP%\'
            - ' > %TMP%\'
    condition: all of selection*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_recon/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection*

Stage 1: `selection_image`

selection_image:
    - Image|endswith:
          - '\tree.com'
          - '\WMIC.exe'
          - '\doskey.exe'
          - '\sc.exe'
    - OriginalFileName:
          - 'wmic.exe'
          - 'DOSKEY.EXE'
          - 'sc.exe'

Stage 2: `selection_redirect`

selection_redirect:
    ParentCommandLine|contains:
        - ' > %TEMP%\'
        - ' > %TMP%\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\WMIC.exe` corpus 62 (sigma 62) `\doskey.exe` `\sc.exe` corpus 30 (sigma 30) `\tree.com`	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`DOSKEY.EXE` `sc.exe` corpus 28 (sigma 12, splunk 10, elastic 6) `wmic.exe` corpus 74 (sigma 38, elastic 18, splunk 18)	`field:"OriginalFileName" kind:eq`
`ParentCommandLine`	match	`> %TEMP%\` `> %TMP%\`	`field:"ParentCommandLine" kind:match`

Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Status: test
Severity: medium
Author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	No specific technique
Execution	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate
id: 41f407b5-3096-44ea-a74f-96d04fbc41be
status: test
description: |
    Detects the execution of an AnyDesk binary with a version prior to 8.0.8.
    Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors.
    Use this rule to detect instances of older versions of Anydesk using the compromised certificate
    This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.
references:
    - https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/
    - https://anydesk.com/en/changelog/windows
author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems)
date: 2024-02-08
tags:
    - attack.execution
    - attack.initial-access
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\AnyDesk.exe'
        - Description: 'AnyDesk'
        - Product: 'AnyDesk'
        - Company: 'AnyDesk Software GmbH'
    selection_version:
        FileVersion|startswith:
            - '7.0.'
            - '7.1.'
            - '8.0.1'
            - '8.0.2'
            - '8.0.3'
            - '8.0.4'
            - '8.0.5'
            - '8.0.6'
            - '8.0.7'
    filter_main_uninstall:
        CommandLine|contains:
            - ' --remove'
            - ' --uninstall'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_main_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\AnyDesk.exe'
    - Description: 'AnyDesk'
    - Product: 'AnyDesk'
    - Company: 'AnyDesk Software GmbH'

Stage 2: `selection_version`

selection_version:
    FileVersion|startswith:
        - '7.0.'
        - '7.1.'
        - '8.0.1'
        - '8.0.2'
        - '8.0.3'
        - '8.0.4'
        - '8.0.5'
        - '8.0.6'
        - '8.0.7'

Stage 3: `not filter_main_uninstall`

filter_main_uninstall:
    CommandLine|contains:
        - ' --remove'
        - ' --uninstall'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Company`	eq	`AnyDesk Software GmbH` corpus 3 (sigma 3)	`field:"Company" kind:eq value:"AnyDesk Software GmbH"`
`Description`	eq	`AnyDesk` corpus 3 (sigma 3)	`field:"Description" kind:eq value:"AnyDesk"`
`FileVersion`	starts_with	`7.0.` `7.1.` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.0.7`	`field:"FileVersion" kind:starts_with`
`Image`	ends_with	`\AnyDesk.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"\AnyDesk.exe"`
`Product`	eq	`AnyDesk` corpus 3 (sigma 3)	`field:"Product" kind:eq value:"AnyDesk"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`--remove`	`excludes:CommandLine` `field:"CommandLine" value:" --remove"`
`CommandLine`	match	`--uninstall`	`excludes:CommandLine` `field:"CommandLine" value:" --uninstall"`

Remote XSL Execution Via Msxsl.EXE

Status: test
Severity: high
Author: Swachchhanda Shrawan Poudel
Source: github.com/SigmaHQ/sigma

Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Known False Positives

Msxsl is not installed by default and is deprecated, so unlikely on most systems.

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	`T1220` XSL Script Processing

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Remote XSL Execution Via Msxsl.EXE
id: 75d0a94e-6252-448d-a7be-d953dff527bb
status: test
description: Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
author: Swachchhanda Shrawan Poudel
date: 2023-11-09
tags:
    - attack.stealth
    - attack.t1220
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\msxsl.exe'
        CommandLine|contains: 'http'
    condition: selection
falsepositives:
    - Msxsl is not installed by default and is deprecated, so unlikely on most systems.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\msxsl.exe'
    CommandLine|contains: 'http'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`http` corpus 45 (sigma 34, elastic 10, splunk 1)	`field:"CommandLine" kind:match value:"http"`
`Image`	ends_with	`\msxsl.exe` corpus 6 (sigma 6)	`field:"Image" kind:ends_with value:"\msxsl.exe"`

Removal of Potential COM Hijacking Registry Keys

Status: test
Severity: medium
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source: github.com/SigmaHQ/sigma

Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.

Known False Positives

Legitimate software (un)installations are known to cause false positives. Please add them as a filter when encountered

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 12: RegistryEvent (Object create and delete)

Rule Body

title: Removal of Potential COM Hijacking Registry Keys
id: 96f697b0-b499-4e5d-9908-a67bec11cdb6
status: test
description: |
    Detects any deletion of entries in ".*\shell\open\command" registry keys.
    These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.
references:
    - https://github.com/OTRF/detection-hackathon-apt29/issues/7
    - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md
    - https://learn.microsoft.com/en-us/windows/win32/shell/launch
    - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
    - https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-05-02
modified: 2025-10-07
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    category: registry_delete
detection:
    selection:
        TargetObject|endswith: '\shell\open\command'
    filter_main_explorer:
        Image|endswith: 'C:\Windows\explorer.exe'
    filter_main_svchost:
        Image: 'C:\Windows\system32\svchost.exe'
    filter_main_msiexec:
        Image:
            - 'C:\Windows\System32\msiexec.exe'
            - 'C:\Windows\SysWOW64\msiexec.exe'
    filter_main_generic_prorams:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_main_openwith:
        Image: 'C:\Windows\System32\OpenWith.exe'
    filter_optional_dropbox:
        Image|endswith: '\Dropbox.exe'
        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
        TargetObject|contains: '\Dropbox.'
    filter_optional_wireshark:
        Image|endswith: '\AppData\Local\Temp\Wireshark_uninstaller.exe'
        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
        TargetObject|contains: '\wireshark-capture-file\'
    filter_optional_peazip:
        Image|contains: 'peazip'
        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
        TargetObject|contains: '\PeaZip.'
    filter_optional_everything:
        Image|endswith: '\Everything.exe'
        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
        TargetObject|contains: '\Everything.'
    filter_optional_uninstallers:
        # This image path is linked with different uninstallers when running as admin unfortunately
        Image|startswith: 'C:\Windows\Installer\MSI'
    filter_optional_java:
        Image|startswith: 'C:\Program Files (x86)\Java\'
        Image|endswith: '\installer.exe'
        TargetObject|contains: '\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}'
    filter_optional_edgeupdate:
        Image|contains: '\Microsoft\EdgeUpdate\Install'
    filter_optional_avira:
        Image:
            - 'C:\Program Files (x86)\Avira\Antivirus\'
            - 'C:\Program Files\Avira\Antivirus\'
        TargetObject|endswith:
            - '\CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command'
            - '\AntiVir.Keyfile\shell\open\command'
    filter_optional_installer_temp:
        - Image|contains|all:
              - 'AppData\Local\Temp'
              - '\setup.exe'
        - Image|contains|all:
              - '\Temp\is-'
              - '\target.tmp'
    filter_optional_ninite:
        Image|endswith: '\ninite.exe'
    filter_optional_discord:
        Image|endswith: '\reg.exe'
        TargetObject|endswith: '\Discord\shell\open\command'
    filter_optional_spotify:
        Image|endswith: '\Spotify.exe'
        TargetObject|endswith: '\Spotify\shell\open\command'
    filter_optional_eclipse:
        Image|endswith: 'C:\eclipse\eclipse.exe'
        TargetObject|contains: '_Classes\eclipse+'
    filter_optional_teamviewer:
        Image|contains|all:
            - '\Temp'
            - '\TeamViewer'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate software (un)installations are known to cause false positives. Please add them as a filter when encountered
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    TargetObject|endswith: '\shell\open\command'

Stage 2: `not filter_main_*`

filter_main_explorer:
    Image|endswith: 'C:\Windows\explorer.exe'
filter_main_svchost:
    Image: 'C:\Windows\system32\svchost.exe'
filter_main_msiexec:
    Image:
        - 'C:\Windows\System32\msiexec.exe'
        - 'C:\Windows\SysWOW64\msiexec.exe'
filter_main_generic_prorams:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
filter_main_openwith:
    Image: 'C:\Windows\System32\OpenWith.exe'

Stage 3: `not filter_optional_*`

filter_optional_dropbox:
    Image|endswith: '\Dropbox.exe'
    TargetObject|contains: '\Dropbox.'
filter_optional_wireshark:
    Image|endswith: '\AppData\Local\Temp\Wireshark_uninstaller.exe'
    TargetObject|contains: '\wireshark-capture-file\'
filter_optional_peazip:
    Image|contains: 'peazip'
    TargetObject|contains: '\PeaZip.'
filter_optional_everything:
    Image|endswith: '\Everything.exe'
    TargetObject|contains: '\Everything.'
filter_optional_uninstallers:
    Image|startswith: 'C:\Windows\Installer\MSI'
filter_optional_java:
    Image|startswith: 'C:\Program Files (x86)\Java\'
    Image|endswith: '\installer.exe'
    TargetObject|contains: '\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}'
filter_optional_edgeupdate:
    Image|contains: '\Microsoft\EdgeUpdate\Install'
filter_optional_avira:
    Image:
        - 'C:\Program Files (x86)\Avira\Antivirus\'
        - 'C:\Program Files\Avira\Antivirus\'
    TargetObject|endswith:
        - '\CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command'
        - '\AntiVir.Keyfile\shell\open\command'
filter_optional_installer_temp:
    - Image|contains|all:
          - 'AppData\Local\Temp'
          - '\setup.exe'
    - Image|contains|all:
          - '\Temp\is-'
          - '\target.tmp'
filter_optional_ninite:
    Image|endswith: '\ninite.exe'
filter_optional_discord:
    Image|endswith: '\reg.exe'
    TargetObject|endswith: '\Discord\shell\open\command'
filter_optional_spotify:
    Image|endswith: '\Spotify.exe'
    TargetObject|endswith: '\Spotify\shell\open\command'
filter_optional_eclipse:
    Image|endswith: 'C:\eclipse\eclipse.exe'
    TargetObject|contains: '_Classes\eclipse+'
filter_optional_teamviewer:
    Image|contains|all:
        - '\Temp'
        - '\TeamViewer'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\shell\open\command`	`field:"TargetObject" kind:ends_with value:"\shell\open\command"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`C:\Windows\explorer.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\explorer.exe"`
`Image`	eq	`C:\Windows\SysWOW64\msiexec.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\msiexec.exe"`
`Image`	eq	`C:\Windows\System32\OpenWith.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\OpenWith.exe"`
`Image`	eq	`C:\Windows\System32\msiexec.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\msiexec.exe"`
`Image`	eq	`C:\Windows\system32\svchost.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\system32\svchost.exe"`
`Image`	starts_with	`C:\Program Files (x86)\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\"`
`Image`	starts_with	`C:\Program Files\`	`excludes:Image` `field:"Image" value:"C:\Program Files\"`
`Image`	eq	`C:\Program Files (x86)\Avira\Antivirus\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\Avira\Antivirus\"`
`Image`	eq	`C:\Program Files\Avira\Antivirus\`	`excludes:Image` `field:"Image" value:"C:\Program Files\Avira\Antivirus\"`
`TargetObject`	ends_with	`\AntiVir.Keyfile\shell\open\command`	`excludes:TargetObject` `field:"TargetObject" value:"\AntiVir.Keyfile\shell\open\command"`
`TargetObject`	ends_with	`\CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command`	`excludes:TargetObject` `field:"TargetObject" value:"\CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command"`
`Image`	ends_with	`C:\eclipse\eclipse.exe`	`excludes:Image` `field:"Image" value:"C:\eclipse\eclipse.exe"`
`TargetObject`	match	`_Classes\eclipse+`	`excludes:TargetObject` `field:"TargetObject" value:"_Classes\eclipse+"`
`Image`	ends_with	`\AppData\Local\Temp\Wireshark_uninstaller.exe`	`excludes:Image` `field:"Image" value:"\AppData\Local\Temp\Wireshark_uninstaller.exe"`
`TargetObject`	match	`\wireshark-capture-file\`	`excludes:TargetObject` `field:"TargetObject" value:"\wireshark-capture-file\"`
`Image`	ends_with	`\Dropbox.exe`	`excludes:Image` `field:"Image" value:"\Dropbox.exe"`
`TargetObject`	match	`\Dropbox.`	`excludes:TargetObject` `field:"TargetObject" value:"\Dropbox."`
`Image`	ends_with	`\Everything.exe`	`excludes:Image` `field:"Image" value:"\Everything.exe"`
`TargetObject`	match	`\Everything.`	`excludes:TargetObject` `field:"TargetObject" value:"\Everything."`
`Image`	ends_with	`\Spotify.exe`	`excludes:Image` `field:"Image" value:"\Spotify.exe"`
`TargetObject`	ends_with	`\Spotify\shell\open\command`	`excludes:TargetObject` `field:"TargetObject" value:"\Spotify\shell\open\command"`
`Image`	ends_with	`\installer.exe`	`excludes:Image` `field:"Image" value:"\installer.exe"`
`Image`	starts_with	`C:\Program Files (x86)\Java\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\Java\"`
`TargetObject`	match	`\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}`	`excludes:TargetObject` `field:"TargetObject" value:"\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}"`
`Image`	ends_with	`\reg.exe`	`excludes:Image` `field:"Image" value:"\reg.exe"`
`TargetObject`	ends_with	`\Discord\shell\open\command`	`excludes:TargetObject` `field:"TargetObject" value:"\Discord\shell\open\command"`
`Image`	match	`AppData\Local\Temp`	`excludes:Image` `field:"Image" value:"AppData\Local\Temp"`
`Image`	match	`\setup.exe`	`excludes:Image` `field:"Image" value:"\setup.exe"`
`Image`	match	`\TeamViewer`	`excludes:Image` `field:"Image" value:"\TeamViewer"`
`Image`	match	`\Temp`	`excludes:Image` `field:"Image" value:"\Temp"`
`Image`	match	`\Temp\is-`	`excludes:Image` `field:"Image" value:"\Temp\is-"`
`Image`	match	`\target.tmp`	`excludes:Image` `field:"Image" value:"\target.tmp"`
`Image`	match	`peazip`	`excludes:Image` `field:"Image" value:"peazip"`
`TargetObject`	match	`\PeaZip.`	`excludes:TargetObject` `field:"TargetObject" value:"\PeaZip."`
`Image`	ends_with	`\ninite.exe`	`excludes:Image` `field:"Image" value:"\ninite.exe"`
`Image`	match	`\Microsoft\EdgeUpdate\Install`	`excludes:Image` `field:"Image" value:"\Microsoft\EdgeUpdate\Install"`
`Image`	starts_with	`C:\Windows\Installer\MSI`	`excludes:Image` `field:"Image" value:"C:\Windows\Installer\MSI"`

Serpent Backdoor Payload Execution Via Scheduled Task

Status: test
Severity: high
Author: @kostastsale
Source: github.com/SigmaHQ/sigma

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task `T1059.006` Command and Scripting Interpreter: Python
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Serpent Backdoor Payload Execution Via Scheduled Task
id: d5eb7432-fda4-4bba-a37f-ffa74d9ed639
status: test
description: |
    Detects post exploitation execution technique of the Serpent backdoor.
    According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
    It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
references:
    - https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
author: '@kostastsale'
date: 2022-03-21
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - attack.t1059.006
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains|all:
            - '[System/EventID='
            - '/create'
            - '/delete'
            - '/ec'
            - '/so'
            - '/tn run'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
    CommandLine|contains|all:
        - '[System/EventID='
        - '/create'
        - '/delete'
        - '/ec'
        - '/so'
        - '/tn run'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/create` corpus 8 (sigma 6, splunk 2) `/delete` corpus 8 (sigma 6, splunk 2) `/ec` `/so` `/tn run` `[System/EventID=`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmd.exe` corpus 132 (sigma 130, splunk 2) `\powershell.exe` corpus 181 (sigma 180, splunk 1)	`field:"Image" kind:ends_with`

Service Installed By Unusual Client - Security

Status: test
Severity: high
Author: Tim Rauch (Nextron Systems), Elastic (idea)
Source: github.com/SigmaHQ/sigma

Detects a service installed by a client which has PID 0 or whose parent has PID 0

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1543` Create or Modify System Process
Privilege Escalation	`T1543` Create or Modify System Process

Telemetry Coverage

Provider	Record / event type
Security-Auditing	Event ID 4697: A service was installed in the system.

Rule Body

title: Service Installed By Unusual Client - Security
id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca
related:
    - id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5
      type: similar
status: test
description: Detects a service installed by a client which has PID 0 or whose parent has PID 0
references:
    - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
    - https://www.x86matthew.com/view_post?id=create_svc_rpc
    - https://twitter.com/SBousseaden/status/1490608838701166596
author: Tim Rauch (Nextron Systems), Elastic (idea)
date: 2022-09-15
modified: 2023-01-04
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543
logsource:
    service: security
    product: windows
    definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697'
detection:
    selection_eid:
        EventID: 4697
    selection_pid:
        - ClientProcessId: 0
        - ParentProcessId: 0
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_eid`

selection_eid:
    EventID: 4697

Stage 2: `selection_pid`

selection_pid:
    - ClientProcessId: 0
    - ParentProcessId: 0

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ClientProcessId`	eq	`0` corpus 2 (sigma 1, elastic 1)	`field:"ClientProcessId" kind:eq value:"0"`
`ParentProcessId`	eq	`0`	`field:"parent_process_id" kind:eq value:"0"`

Suspicious Diantz Download and Compress Into a CAB File

Status: test
Severity: medium
Author: frack113
Source: github.com/SigmaHQ/sigma

Download and compress a remote file and store it in a cab file on local machine.

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1105` Ingress Tool Transfer

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Suspicious Diantz Download and Compress Into a CAB File
id: 185d7418-f250-42d0-b72e-0c8b70661e93
status: test
description: Download and compress a remote file and store it in a cab file on local machine.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Diantz/
author: frack113
date: 2021-11-26
modified: 2022-08-13
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - diantz.exe
            - ' \\\\'
            - '.cab'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    CommandLine|contains|all:
        - diantz.exe
        - ' \\\\'
        - '.cab'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`\\\\` corpus 8 (sigma 8) `.cab` corpus 5 (sigma 5) `diantz.exe` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`

Suspicious File Access to Browser Credential Storage

Status: experimental
Severity: low
Author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore
Source: github.com/SigmaHQ/sigma

Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.

Known False Positives

Antivirus, Anti-Spyware, Anti-Malware Software
Legitimate software accessing browser data for synchronization or backup purposes.
Legitimate software installed on partitions other than "C:\"

MITRE ATT&CK Coverage

Tactic	Techniques
Credential Access	`T1555.003` Credentials from Password Stores: Credentials from Web Browsers
Discovery	`T1217` Browser Information Discovery

Rule Body

title: Suspicious File Access to Browser Credential Storage
id: a1dfd976-4852-41d4-9507-dc6590a3ccd0
status: experimental
description: |
    Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts.
    Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.
    This behavior is often commonly observed in credential stealing malware.
references:
    - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1
    - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing
author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore
date: 2025-05-22
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.discovery
    - attack.t1217
logsource:
    category: file_access
    product: windows
detection:
    selection_browser_paths:
        FileName|contains:
            - '\Sputnik\Sputnik'
            - '\MapleStudio\ChromePlus'
            - '\QIP Surf'
            - '\BlackHawk'
            - '\7Star\7Star'
            - '\CatalinaGroup\Citrio'
            - '\Google\Chrome'
            - '\Coowon\Coowon'
            - '\CocCoc\Browser'
            - '\uCozMedia\Uran'
            - '\Tencent\QQBrowser'
            - '\Orbitum'
            - '\Slimjet'
            - '\Iridium'
            - '\Vivaldi'
            - '\Chromium'
            - '\GhostBrowser'
            - '\CentBrowser'
            - '\Xvast'
            - '\Chedot'
            - '\SuperBird'
            - '\360Browser\Browser'
            - '\360Chrome\Chrome'
            - '\Comodo\Dragon'
            - '\BraveSoftware\Brave-Browser'
            - '\Torch'
            - '\UCBrowser\'
            - '\Blisk'
            - '\Epic Privacy Browser'
            - '\Nichrome'
            - '\Amigo'
            - '\Kometa'
            - '\Xpom'
            - '\Microsoft\Edge'
            - '\Liebao7Default\EncryptedStorage'
            - '\AVAST Software\Browser'
            - '\Kinza'
            - '\Mozilla\SeaMonkey\'
            - '\Comodo\IceDragon\'
            - '\8pecxstudios\Cyberfox\'
            - '\FlashPeak\SlimBrowser\'
            - '\Moonchild Productions\Pale Moon\'
    selection_browser_subpaths:
        FileName|contains:
            - '\Profiles\'
            - '\User Data'
    selection_cred_files:
        - FileName|contains:
              - '\Login Data'
              - '\Cookies'
              - '\EncryptedStorage'
              - '\WebCache\'
        - FileName|endswith:
              - 'cert9.db'
              - 'cookies.sqlite'
              - 'formhistory.sqlite'
              - 'key3.db'
              - 'key4.db'
              - 'Login Data.sqlite'
              - 'logins.json'
              - 'places.sqlite'
    filter_main_img:
        Image|endswith:
            - '\Sputnik.exe'
            - '\ChromePlus.exe'
            - '\QIP Surf.exe'
            - '\BlackHawk.exe'
            - '\7Star.exe'
            - '\Sleipnir5.exe'
            - '\Citrio.exe'
            - '\Chrome SxS.exe'
            - '\Chrome.exe'
            - '\Coowon.exe'
            - '\CocCocBrowser.exe'
            - '\Uran.exe'
            - '\QQBrowser.exe'
            - '\Orbitum.exe'
            - '\Slimjet.exe'
            - '\Iridium.exe'
            - '\Vivaldi.exe'
            - '\Chromium.exe'
            - '\GhostBrowser.exe'
            - '\CentBrowser.exe'
            - '\Xvast.exe'
            - '\Chedot.exe'
            - '\SuperBird.exe'
            - '\360Browser.exe'
            - '\360Chrome.exe'
            - '\dragon.exe'
            - '\brave.exe'
            - '\torch.exe'
            - '\UCBrowser.exe'
            - '\BliskBrowser.exe'
            - '\Epic Privacy Browser.exe'
            - '\nichrome.exe'
            - '\AmigoBrowser.exe'
            - '\KometaBrowser.exe'
            - '\XpomBrowser.exe'
            - '\msedge.exe'
            - '\LiebaoBrowser.exe'
            - '\AvastBrowser.exe'
            - '\Kinza.exe'
            - '\seamonkey.exe'
            - '\icedragon.exe'
            - '\cyberfox.exe'
            - '\SlimBrowser.exe'
            - '\palemoon.exe'
    filter_main_path:
        Image|contains:
            - '\Sputnik\'
            - '\MapleStudio\'
            - '\QIP Surf\'
            - '\BlackHawk\'
            - '\7Star\'
            - '\Fenrir Inc\'
            - '\CatalinaGroup\'
            - '\Google\'
            - '\Coowon\'
            - '\CocCoc\'
            - '\uCozMedia\'
            - '\Tencent\'
            - '\Orbitum\'
            - '\Slimjet\'
            - '\Iridium\'
            - '\Vivaldi\'
            - '\Chromium\'
            - '\GhostBrowser\'
            - '\CentBrowser\'
            - '\Xvast\'
            - '\Chedot\'
            - '\SuperBird\'
            - '\360Browser\'
            - '\360Chrome\'
            - '\Comodo\'
            - '\BraveSoftware\'
            - '\Torch\'
            - '\UCBrowser\'
            - '\Blisk\'
            - '\Epic Privacy Browser\'
            - '\Nichrome\'
            - '\Amigo\'
            - '\Kometa\'
            - '\Xpom\'
            - '\Microsoft\'
            - '\Liebao7\'
            - '\AVAST Software\'
            - '\Kinza\'
            - '\Mozilla\'
            - '\8pecxstudios\'
            - '\FlashPeak\'
            - '\Moonchild Productions\'
    filter_main_system:
        Image: System
        ParentImage: Idle
    filter_main_generic:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    filter_optional_defender:
        Image|contains: '\Microsoft\Windows Defender\'
        Image|endswith:
            - '\MpCopyAccelerator.exe'
            - '\MsMpEng.exe'
    filter_optional_thor:
        Image|endswith:
            - '\thor.exe'
            - '\thor64.exe'
    filter_optional_msiexec:
        ParentImage: 'C:\Windows\System32\msiexec.exe'
    filter_optional_other:
        Image|endswith: '\everything.exe'
    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Antivirus, Anti-Spyware, Anti-Malware Software
    - Legitimate software accessing browser data for synchronization or backup purposes.
    - Legitimate software installed on partitions other than "C:\"
level: low

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection_browser_paths`

selection_browser_paths:
    FileName|contains:
        - '\Sputnik\Sputnik'
        - '\MapleStudio\ChromePlus'
        - '\QIP Surf'
        - '\BlackHawk'
        - '\7Star\7Star'
        - '\CatalinaGroup\Citrio'
        - '\Google\Chrome'
        - '\Coowon\Coowon'
        - '\CocCoc\Browser'
        - '\uCozMedia\Uran'
        - '\Tencent\QQBrowser'
        - '\Orbitum'
        - '\Slimjet'
        - '\Iridium'
        - '\Vivaldi'
        - '\Chromium'
        - '\GhostBrowser'
        - '\CentBrowser'
        - '\Xvast'
        - '\Chedot'
        - '\SuperBird'
        - '\360Browser\Browser'
        - '\360Chrome\Chrome'
        - '\Comodo\Dragon'
        - '\BraveSoftware\Brave-Browser'
        - '\Torch'
        - '\UCBrowser\'
        - '\Blisk'
        - '\Epic Privacy Browser'
        - '\Nichrome'
        - '\Amigo'
        - '\Kometa'
        - '\Xpom'
        - '\Microsoft\Edge'
        - '\Liebao7Default\EncryptedStorage'
        - '\AVAST Software\Browser'
        - '\Kinza'
        - '\Mozilla\SeaMonkey\'
        - '\Comodo\IceDragon\'
        - '\8pecxstudios\Cyberfox\'
        - '\FlashPeak\SlimBrowser\'
        - '\Moonchild Productions\Pale Moon\'

Stage 2: `selection_browser_subpaths`

selection_browser_subpaths:
    FileName|contains:
        - '\Profiles\'
        - '\User Data'

Stage 3: `selection_cred_files`

selection_cred_files:
    - FileName|contains:
          - '\Login Data'
          - '\Cookies'
          - '\EncryptedStorage'
          - '\WebCache\'
    - FileName|endswith:
          - 'cert9.db'
          - 'cookies.sqlite'
          - 'formhistory.sqlite'
          - 'key3.db'
          - 'key4.db'
          - 'Login Data.sqlite'
          - 'logins.json'
          - 'places.sqlite'

Stage 4: `not filter_main_*`

filter_main_img:
    Image|endswith:
        - '\Sputnik.exe'
        - '\ChromePlus.exe'
        - '\QIP Surf.exe'
        - '\BlackHawk.exe'
        - '\7Star.exe'
        - '\Sleipnir5.exe'
        - '\Citrio.exe'
        - '\Chrome SxS.exe'
        - '\Chrome.exe'
        - '\Coowon.exe'
        - '\CocCocBrowser.exe'
        - '\Uran.exe'
        - '\QQBrowser.exe'
        - '\Orbitum.exe'
        - '\Slimjet.exe'
        - '\Iridium.exe'
        - '\Vivaldi.exe'
        - '\Chromium.exe'
        - '\GhostBrowser.exe'
        - '\CentBrowser.exe'
        - '\Xvast.exe'
        - '\Chedot.exe'
        - '\SuperBird.exe'
        - '\360Browser.exe'
        - '\360Chrome.exe'
        - '\dragon.exe'
        - '\brave.exe'
        - '\torch.exe'
        - '\UCBrowser.exe'
        - '\BliskBrowser.exe'
        - '\Epic Privacy Browser.exe'
        - '\nichrome.exe'
        - '\AmigoBrowser.exe'
        - '\KometaBrowser.exe'
        - '\XpomBrowser.exe'
        - '\msedge.exe'
        - '\LiebaoBrowser.exe'
        - '\AvastBrowser.exe'
        - '\Kinza.exe'
        - '\seamonkey.exe'
        - '\icedragon.exe'
        - '\cyberfox.exe'
        - '\SlimBrowser.exe'
        - '\palemoon.exe'
filter_main_path:
    Image|contains:
        - '\Sputnik\'
        - '\MapleStudio\'
        - '\QIP Surf\'
        - '\BlackHawk\'
        - '\7Star\'
        - '\Fenrir Inc\'
        - '\CatalinaGroup\'
        - '\Google\'
        - '\Coowon\'
        - '\CocCoc\'
        - '\uCozMedia\'
        - '\Tencent\'
        - '\Orbitum\'
        - '\Slimjet\'
        - '\Iridium\'
        - '\Vivaldi\'
        - '\Chromium\'
        - '\GhostBrowser\'
        - '\CentBrowser\'
        - '\Xvast\'
        - '\Chedot\'
        - '\SuperBird\'
        - '\360Browser\'
        - '\360Chrome\'
        - '\Comodo\'
        - '\BraveSoftware\'
        - '\Torch\'
        - '\UCBrowser\'
        - '\Blisk\'
        - '\Epic Privacy Browser\'
        - '\Nichrome\'
        - '\Amigo\'
        - '\Kometa\'
        - '\Xpom\'
        - '\Microsoft\'
        - '\Liebao7\'
        - '\AVAST Software\'
        - '\Kinza\'
        - '\Mozilla\'
        - '\8pecxstudios\'
        - '\FlashPeak\'
        - '\Moonchild Productions\'
filter_main_system:
    Image: System
    ParentImage: Idle
filter_main_generic:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'

Stage 5: `not filter_optional_*`

filter_optional_defender:
    Image|contains: '\Microsoft\Windows Defender\'
    Image|endswith:
        - '\MpCopyAccelerator.exe'
        - '\MsMpEng.exe'
filter_optional_thor:
    Image|endswith:
        - '\thor.exe'
        - '\thor64.exe'
filter_optional_msiexec:
    ParentImage: 'C:\Windows\System32\msiexec.exe'
filter_optional_other:
    Image|endswith: '\everything.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`FileName`	ends_with	`Login Data.sqlite` `cert9.db` `cookies.sqlite` `formhistory.sqlite` `key3.db` `key4.db` `logins.json` `places.sqlite`	`field:"file_name" kind:ends_with`
`FileName`	match	`\360Browser\Browser` `\360Chrome\Chrome` `\7Star\7Star` `\8pecxstudios\Cyberfox\` `\AVAST Software\Browser` `\Amigo` `\BlackHawk` `\Blisk` `\BraveSoftware\Brave-Browser` `\CatalinaGroup\Citrio` `\CentBrowser` `\Chedot` `\Chromium` `\CocCoc\Browser` `\Comodo\Dragon` `\Comodo\IceDragon\` `\Cookies` `\Coowon\Coowon` `\EncryptedStorage` `\Epic Privacy Browser` `\FlashPeak\SlimBrowser\` `\GhostBrowser` `\Google\Chrome` `\Iridium` `\Kinza` `\Kometa` `\Liebao7Default\EncryptedStorage` `\Login Data` `\MapleStudio\ChromePlus` `\Microsoft\Edge` `\Moonchild Productions\Pale Moon\` `\Mozilla\SeaMonkey\` `\Nichrome` `\Orbitum` `\Profiles\` `\QIP Surf` `\Slimjet` `\Sputnik\Sputnik` `\SuperBird` `\Tencent\QQBrowser` `\Torch` `\UCBrowser\` `\User Data` `\Vivaldi` `\WebCache\` `\Xpom` `\Xvast` `\uCozMedia\Uran`	`field:"file_name" kind:match`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`System`	`excludes:Image` `field:"Image" value:"System"`
`ParentImage`	eq	`Idle`	`excludes:ParentImage` `field:"ParentImage" value:"Idle"`
`Image`	ends_with	`\360Browser.exe`	`excludes:Image` `field:"Image" value:"\360Browser.exe"`
`Image`	ends_with	`\360Chrome.exe`	`excludes:Image` `field:"Image" value:"\360Chrome.exe"`
`Image`	ends_with	`\7Star.exe`	`excludes:Image` `field:"Image" value:"\7Star.exe"`
`Image`	ends_with	`\AmigoBrowser.exe`	`excludes:Image` `field:"Image" value:"\AmigoBrowser.exe"`
`Image`	ends_with	`\AvastBrowser.exe`	`excludes:Image` `field:"Image" value:"\AvastBrowser.exe"`
`Image`	ends_with	`\BlackHawk.exe`	`excludes:Image` `field:"Image" value:"\BlackHawk.exe"`
`Image`	ends_with	`\BliskBrowser.exe`	`excludes:Image` `field:"Image" value:"\BliskBrowser.exe"`
`Image`	ends_with	`\CentBrowser.exe`	`excludes:Image` `field:"Image" value:"\CentBrowser.exe"`
`Image`	ends_with	`\Chedot.exe`	`excludes:Image` `field:"Image" value:"\Chedot.exe"`
`Image`	ends_with	`\Chrome SxS.exe`	`excludes:Image` `field:"Image" value:"\Chrome SxS.exe"`
`Image`	ends_with	`\Chrome.exe`	`excludes:Image` `field:"Image" value:"\Chrome.exe"`
`Image`	ends_with	`\ChromePlus.exe`	`excludes:Image` `field:"Image" value:"\ChromePlus.exe"`
`Image`	ends_with	`\Chromium.exe`	`excludes:Image` `field:"Image" value:"\Chromium.exe"`
`Image`	ends_with	`\Citrio.exe`	`excludes:Image` `field:"Image" value:"\Citrio.exe"`
`Image`	ends_with	`\CocCocBrowser.exe`	`excludes:Image` `field:"Image" value:"\CocCocBrowser.exe"`
`Image`	ends_with	`\Coowon.exe`	`excludes:Image` `field:"Image" value:"\Coowon.exe"`
`Image`	ends_with	`\Epic Privacy Browser.exe`	`excludes:Image` `field:"Image" value:"\Epic Privacy Browser.exe"`
`Image`	ends_with	`\GhostBrowser.exe`	`excludes:Image` `field:"Image" value:"\GhostBrowser.exe"`
`Image`	ends_with	`\Iridium.exe`	`excludes:Image` `field:"Image" value:"\Iridium.exe"`
`Image`	ends_with	`\Kinza.exe`	`excludes:Image` `field:"Image" value:"\Kinza.exe"`
`Image`	ends_with	`\KometaBrowser.exe`	`excludes:Image` `field:"Image" value:"\KometaBrowser.exe"`
`Image`	ends_with	`\LiebaoBrowser.exe`	`excludes:Image` `field:"Image" value:"\LiebaoBrowser.exe"`
`Image`	ends_with	`\Orbitum.exe`	`excludes:Image` `field:"Image" value:"\Orbitum.exe"`
`Image`	ends_with	`\QIP Surf.exe`	`excludes:Image` `field:"Image" value:"\QIP Surf.exe"`
`Image`	ends_with	`\QQBrowser.exe`	`excludes:Image` `field:"Image" value:"\QQBrowser.exe"`
`Image`	ends_with	`\Sleipnir5.exe`	`excludes:Image` `field:"Image" value:"\Sleipnir5.exe"`
`Image`	ends_with	`\SlimBrowser.exe`	`excludes:Image` `field:"Image" value:"\SlimBrowser.exe"`
`Image`	ends_with	`\Slimjet.exe`	`excludes:Image` `field:"Image" value:"\Slimjet.exe"`
`Image`	ends_with	`\Sputnik.exe`	`excludes:Image` `field:"Image" value:"\Sputnik.exe"`
`Image`	ends_with	`\SuperBird.exe`	`excludes:Image` `field:"Image" value:"\SuperBird.exe"`
`Image`	ends_with	`\UCBrowser.exe`	`excludes:Image` `field:"Image" value:"\UCBrowser.exe"`
`Image`	ends_with	`\Uran.exe`	`excludes:Image` `field:"Image" value:"\Uran.exe"`
`Image`	ends_with	`\Vivaldi.exe`	`excludes:Image` `field:"Image" value:"\Vivaldi.exe"`
`Image`	ends_with	`\XpomBrowser.exe`	`excludes:Image` `field:"Image" value:"\XpomBrowser.exe"`
`Image`	ends_with	`\Xvast.exe`	`excludes:Image` `field:"Image" value:"\Xvast.exe"`
`Image`	ends_with	`\brave.exe`	`excludes:Image` `field:"Image" value:"\brave.exe"`
`Image`	ends_with	`\cyberfox.exe`	`excludes:Image` `field:"Image" value:"\cyberfox.exe"`
`Image`	ends_with	`\dragon.exe`	`excludes:Image` `field:"Image" value:"\dragon.exe"`
`Image`	ends_with	`\icedragon.exe`	`excludes:Image` `field:"Image" value:"\icedragon.exe"`
`Image`	ends_with	`\msedge.exe`	`excludes:Image` `field:"Image" value:"\msedge.exe"`
`Image`	ends_with	`\nichrome.exe`	`excludes:Image` `field:"Image" value:"\nichrome.exe"`
`Image`	ends_with	`\palemoon.exe`	`excludes:Image` `field:"Image" value:"\palemoon.exe"`
`Image`	ends_with	`\seamonkey.exe`	`excludes:Image` `field:"Image" value:"\seamonkey.exe"`
`Image`	ends_with	`\torch.exe`	`excludes:Image` `field:"Image" value:"\torch.exe"`
`Image`	match	`\360Browser\`	`excludes:Image` `field:"Image" value:"\360Browser\"`
`Image`	match	`\360Chrome\`	`excludes:Image` `field:"Image" value:"\360Chrome\"`
`Image`	match	`\7Star\`	`excludes:Image` `field:"Image" value:"\7Star\"`
`Image`	match	`\8pecxstudios\`	`excludes:Image` `field:"Image" value:"\8pecxstudios\"`
`Image`	match	`\AVAST Software\`	`excludes:Image` `field:"Image" value:"\AVAST Software\"`
`Image`	match	`\Amigo\`	`excludes:Image` `field:"Image" value:"\Amigo\"`
`Image`	match	`\BlackHawk\`	`excludes:Image` `field:"Image" value:"\BlackHawk\"`
`Image`	match	`\Blisk\`	`excludes:Image` `field:"Image" value:"\Blisk\"`
`Image`	match	`\BraveSoftware\`	`excludes:Image` `field:"Image" value:"\BraveSoftware\"`
`Image`	match	`\CatalinaGroup\`	`excludes:Image` `field:"Image" value:"\CatalinaGroup\"`
`Image`	match	`\CentBrowser\`	`excludes:Image` `field:"Image" value:"\CentBrowser\"`
`Image`	match	`\Chedot\`	`excludes:Image` `field:"Image" value:"\Chedot\"`
`Image`	match	`\Chromium\`	`excludes:Image` `field:"Image" value:"\Chromium\"`
`Image`	match	`\CocCoc\`	`excludes:Image` `field:"Image" value:"\CocCoc\"`
`Image`	match	`\Comodo\`	`excludes:Image` `field:"Image" value:"\Comodo\"`
`Image`	match	`\Coowon\`	`excludes:Image` `field:"Image" value:"\Coowon\"`
`Image`	match	`\Epic Privacy Browser\`	`excludes:Image` `field:"Image" value:"\Epic Privacy Browser\"`
`Image`	match	`\Fenrir Inc\`	`excludes:Image` `field:"Image" value:"\Fenrir Inc\"`
`Image`	match	`\FlashPeak\`	`excludes:Image` `field:"Image" value:"\FlashPeak\"`
`Image`	match	`\GhostBrowser\`	`excludes:Image` `field:"Image" value:"\GhostBrowser\"`
`Image`	match	`\Google\`	`excludes:Image` `field:"Image" value:"\Google\"`
`Image`	match	`\Iridium\`	`excludes:Image` `field:"Image" value:"\Iridium\"`
`Image`	match	`\Kinza\`	`excludes:Image` `field:"Image" value:"\Kinza\"`
`Image`	match	`\Kometa\`	`excludes:Image` `field:"Image" value:"\Kometa\"`
`Image`	match	`\Liebao7\`	`excludes:Image` `field:"Image" value:"\Liebao7\"`
`Image`	match	`\MapleStudio\`	`excludes:Image` `field:"Image" value:"\MapleStudio\"`
`Image`	match	`\Microsoft\`	`excludes:Image` `field:"Image" value:"\Microsoft\"`
`Image`	match	`\Moonchild Productions\`	`excludes:Image` `field:"Image" value:"\Moonchild Productions\"`
`Image`	match	`\Mozilla\`	`excludes:Image` `field:"Image" value:"\Mozilla\"`
`Image`	match	`\Nichrome\`	`excludes:Image` `field:"Image" value:"\Nichrome\"`
`Image`	match	`\Orbitum\`	`excludes:Image` `field:"Image" value:"\Orbitum\"`
`Image`	match	`\QIP Surf\`	`excludes:Image` `field:"Image" value:"\QIP Surf\"`
`Image`	match	`\Slimjet\`	`excludes:Image` `field:"Image" value:"\Slimjet\"`
`Image`	match	`\Sputnik\`	`excludes:Image` `field:"Image" value:"\Sputnik\"`
`Image`	match	`\SuperBird\`	`excludes:Image` `field:"Image" value:"\SuperBird\"`
`Image`	match	`\Tencent\`	`excludes:Image` `field:"Image" value:"\Tencent\"`
`Image`	match	`\Torch\`	`excludes:Image` `field:"Image" value:"\Torch\"`
`Image`	match	`\UCBrowser\`	`excludes:Image` `field:"Image" value:"\UCBrowser\"`
`Image`	match	`\Vivaldi\`	`excludes:Image` `field:"Image" value:"\Vivaldi\"`
`Image`	match	`\Xpom\`	`excludes:Image` `field:"Image" value:"\Xpom\"`
`Image`	match	`\Xvast\`	`excludes:Image` `field:"Image" value:"\Xvast\"`
`Image`	match	`\uCozMedia\`	`excludes:Image` `field:"Image" value:"\uCozMedia\"`
`Image`	starts_with	`C:\Program Files (x86)\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\"`
`Image`	starts_with	`C:\Program Files\`	`excludes:Image` `field:"Image" value:"C:\Program Files\"`
`Image`	starts_with	`C:\Windows\SysWOW64\`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\"`
`Image`	starts_with	`C:\Windows\System32\`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\"`
`Image`	ends_with	`\MpCopyAccelerator.exe`	`excludes:Image` `field:"Image" value:"\MpCopyAccelerator.exe"`
`Image`	ends_with	`\MsMpEng.exe`	`excludes:Image` `field:"Image" value:"\MsMpEng.exe"`
`Image`	match	`\Microsoft\Windows Defender\`	`excludes:Image` `field:"Image" value:"\Microsoft\Windows Defender\"`
`Image`	ends_with	`\everything.exe`	`excludes:Image` `field:"Image" value:"\everything.exe"`
`Image`	ends_with	`\thor.exe`	`excludes:Image` `field:"Image" value:"\thor.exe"`
`Image`	ends_with	`\thor64.exe`	`excludes:Image` `field:"Image" value:"\thor64.exe"`
`ParentImage`	eq	`C:\Windows\System32\msiexec.exe`	`excludes:ParentImage` `field:"ParentImage" value:"C:\Windows\System32\msiexec.exe"`

Suspicious Inbox Forwarding

Status: test
Severity: low
Author: Austin Songer @austinsonger
Source: github.com/SigmaHQ/sigma

Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.

MITRE ATT&CK Coverage

Tactic	Techniques
Exfiltration	`T1020` Automated Exfiltration

Telemetry Coverage

Platform	Record / event type
Microsoft 365	Suspicious inbox forwarding

Rule Body

title: Suspicious Inbox Forwarding
id: 6c220477-0b5b-4b25-bb90-66183b4089e8
status: test
description: Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.
references:
    - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
    - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
author: Austin Songer @austinsonger
date: 2021-08-22
modified: 2022-10-09
tags:
    - attack.exfiltration
    - attack.t1020
logsource:
    service: threat_management
    product: m365
detection:
    selection:
        eventSource: SecurityComplianceCenter
        eventName: 'Suspicious inbox forwarding'
        status: success
    condition: selection
falsepositives:
    - Unknown
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: SecurityComplianceCenter
    eventName: 'Suspicious inbox forwarding'
    status: success

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`Suspicious inbox forwarding`	`field:"aws::eventName" kind:eq value:"Suspicious inbox forwarding"`
`eventSource`	eq	`SecurityComplianceCenter` corpus 14 (sigma 14)	`field:"aws::eventSource" kind:eq value:"SecurityComplianceCenter"`
`status`	eq	`success` corpus 21 (sigma 15, splunk 6)	`field:"status" kind:eq value:"success"`

Suspicious MSExchangeMailboxReplication ASPX Write

Status: test
Severity: high
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Persistence	`T1505.003` Server Software Component: Web Shell

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule Body

title: Suspicious MSExchangeMailboxReplication ASPX Write
id: 7280c9f3-a5af-45d0-916a-bc01cb4151c9
status: test
description: Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation
references:
    - https://redcanary.com/blog/blackbyte-ransomware/
author: Florian Roth (Nextron Systems)
date: 2022-02-25
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\MSExchangeMailboxReplication.exe'
        TargetFilename|endswith:
            - '.aspx'
            - '.asp'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\MSExchangeMailboxReplication.exe'
    TargetFilename|endswith:
        - '.aspx'
        - '.asp'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\MSExchangeMailboxReplication.exe`	`field:"Image" kind:ends_with value:"\MSExchangeMailboxReplication.exe"`
`TargetFilename`	ends_with	`.asp` corpus 4 (sigma 4) `.aspx` corpus 5 (sigma 5)	`field:"TargetFilename" kind:ends_with`

Suspicious NTLM Authentication on the Printer Spooler Service

Status: test
Severity: high
Author: Elastic (idea), Tobias Michalski (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

MITRE ATT&CK Coverage

Tactic	Techniques
Credential Access	`T1212` Exploitation for Credential Access

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Suspicious NTLM Authentication on the Printer Spooler Service
id: bb76d96b-821c-47cf-944b-7ce377864492
status: test
description: Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service
references:
    - https://twitter.com/med0x2e/status/1520402518685200384
    - https://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml
author: Elastic (idea), Tobias Michalski (Nextron Systems)
date: 2022-05-04
modified: 2023-02-09
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.t1212
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: 'RUNDLL32.EXE'
    selection_cli:
        CommandLine|contains|all:
            - 'C:\windows\system32\davclnt.dll,DavSetCookie'
            - 'http'
        CommandLine|contains:
            - 'spoolss'
            - 'srvsvc'
            - '/print/pipe/'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - 'C:\windows\system32\davclnt.dll,DavSetCookie'
        - 'http'
    CommandLine|contains:
        - 'spoolss'
        - 'srvsvc'
        - '/print/pipe/'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/print/pipe/` `C:\windows\system32\davclnt.dll,DavSetCookie` corpus 3 (sigma 3) `http` corpus 45 (sigma 34, elastic 10, splunk 1) `spoolss` `srvsvc`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\rundll32.exe` corpus 94 (sigma 94)	`field:"Image" kind:ends_with value:"\rundll32.exe"`
`OriginalFileName`	eq	`RUNDLL32.EXE` corpus 72 (sigma 35, splunk 21, elastic 16)	`field:"OriginalFileName" kind:eq value:"RUNDLL32.EXE"`

Suspicious PowerShell Download - PoshModule

Status: test
Severity: medium
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious PowerShell download command

Known False Positives

PowerShell scripts that download content from the Internet

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry Coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.

Rule Body

title: Suspicious PowerShell Download - PoshModule
id: de41232e-12e8-49fa-86bc-c05c7e722df9
related:
    - id: 65531a81-a694-4e31-ae04-f8ba5bc33759
      type: derived
status: test
description: Detects suspicious PowerShell download command
references:
    - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
    - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
author: Florian Roth (Nextron Systems)
date: 2017-03-05
modified: 2023-01-20
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection_webclient_:
        ContextInfo|contains: 'System.Net.WebClient'
    selection_function:
        ContextInfo|contains:
            - '.DownloadFile('
            - '.DownloadString('
    condition: all of selection_*
falsepositives:
    - PowerShell scripts that download content from the Internet
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_webclient_`

selection_webclient_:
    ContextInfo|contains: 'System.Net.WebClient'

Stage 2: `selection_function`

selection_function:
    ContextInfo|contains:
        - '.DownloadFile('
        - '.DownloadString('

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ContextInfo`	match	`.DownloadFile(` `.DownloadString(` `System.Net.WebClient` corpus 2 (sigma 2)	`field:"ContextInfo" kind:match`

System Shutdown/Reboot - Linux

Status: test
Severity: informational
Author: Igor Fits, oscd.community
Source: github.com/SigmaHQ/sigma

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Known False Positives

Legitimate administrative activity

MITRE ATT&CK Coverage

Tactic	Techniques
Impact	`T1529` System Shutdown/Reboot

Telemetry Coverage

Platform	Record / event type
Linux	auditd EXECVE record: Arguments supplied to the execve system call

Rule Body

title: System Shutdown/Reboot - Linux
id: 4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f
status: test
description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
author: 'Igor Fits, oscd.community'
date: 2020-10-15
modified: 2022-11-26
tags:
    - attack.impact
    - attack.t1529
logsource:
    product: linux
    service: auditd
detection:
    execve:
        type: 'EXECVE'
    shutdowncmd:
        - 'shutdown'
        - 'reboot'
        - 'halt'
        - 'poweroff'
    init:
        - 'init'
        - 'telinit'
    initselection:
        - 0
        - 6
    condition: execve and (shutdowncmd or (init and initselection))
falsepositives:
    - Legitimate administrative activity
level: informational

Stages and Predicates

Stage 0: `condition`

execve and (shutdowncmd or (init and initselection))

Stage 1: `execve`

execve:
    type: 'EXECVE'

Stage 2: `shutdowncmd`

shutdowncmd:
    - 'shutdown'
    - 'reboot'
    - 'halt'
    - 'poweroff'

Stage 3: `init`

init:
    - 'init'
    - 'telinit'

Stage 4: `initselection`

initselection:
    - 0
    - 6

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type`	eq	`EXECVE` corpus 37 (sigma 31, splunk 6)	`field:"type" kind:eq value:"EXECVE"`

Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location

Status: test
Severity: low
Author: Swachchhanda Shrawan Poudel
Source: github.com/SigmaHQ/sigma

Detects the loading of the "taskschd.dll" module from a process that located in a potentially suspicious or uncommon directory. The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object. Investigation of the loading application and its behavior is required to determining if its malicious.

Known False Positives

Some installers might generate false positives, apply additional filters accordingly.

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule Body

title: Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location
id: 3b92a1d0-8d4b-4d28-a1b4-1e29d49a6a3e
status: test
description: |
    Detects the loading of the "taskschd.dll" module from a process that located in a potentially suspicious or uncommon directory.
    The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object.
    Investigation of the loading application and its behavior is required to determining if its malicious.
references:
    - https://www.logpoint.com/en/blog/shenanigans-of-scheduled-tasks/
    - https://x.com/Max_Mal_/status/1826179497084739829
author: Swachchhanda Shrawan Poudel
date: 2024-09-02
tags:
    - attack.persistence
    - attack.execution
    - attack.privilege-escalation
    - attack.t1053.005
    - detection.threat-hunting
logsource:
    category: image_load
    product: windows
detection:
    selection_dll:
        - ImageLoaded|endswith: '\taskschd.dll'
        - OriginalFileName: 'taskschd.dll'
    selection_paths:
        Image|contains:
            - ':\Temp\'
            - ':\Users\Public\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp\'
            - '\Desktop\'
            - '\Downloads\'
    condition: all of selection_*
falsepositives:
    - Some installers might generate false positives, apply additional filters accordingly.
level: low

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_dll`

selection_dll:
    - ImageLoaded|endswith: '\taskschd.dll'
    - OriginalFileName: 'taskschd.dll'

Stage 2: `selection_paths`

selection_paths:
    Image|contains:
        - ':\Temp\'
        - ':\Users\Public\'
        - ':\Windows\Temp\'
        - '\AppData\Local\Temp\'
        - '\Desktop\'
        - '\Downloads\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	match	`:\Temp\` corpus 11 (sigma 11) `:\Users\Public\` corpus 13 (sigma 13) `:\Windows\Temp\` corpus 8 (sigma 8) `\AppData\Local\Temp\` corpus 11 (sigma 10, splunk 1) `\Desktop\` corpus 6 (sigma 6) `\Downloads\` corpus 9 (sigma 9)	`field:"Image" kind:match`
`ImageLoaded`	ends_with	`\taskschd.dll` corpus 3 (splunk 2, sigma 1)	`field:"ImageLoaded" kind:ends_with value:"\taskschd.dll"`
`OriginalFileName`	eq	`taskschd.dll`	`field:"OriginalFileName" kind:eq value:"taskschd.dll"`

UAC Bypass Using Windows Media Player - Process

Status: test
Severity: high
Author: Christian Burkard (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

MITRE ATT&CK Coverage

Tactic	Techniques
Privilege Escalation	`T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: UAC Bypass Using Windows Media Player - Process
id: 0058b9e5-bcd7-40d4-9205-95ca5a16d7b2
status: test
description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img_1:
        Image: 'C:\Program Files\Windows Media Player\osk.exe'
    selection_img_2:
        Image: 'C:\Windows\System32\cmd.exe'
        ParentCommandLine: '"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s'
    selection_integrity:
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    condition: 1 of selection_img_* and selection_integrity
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection_img_* and selection_integrity

Stage 1: `selection_img_1`

selection_img_1:
    Image: 'C:\Program Files\Windows Media Player\osk.exe'

Stage 2: `selection_img_2`

selection_img_2:
    Image: 'C:\Windows\System32\cmd.exe'
    ParentCommandLine: '"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s'

Stage 3: `selection_integrity`

selection_integrity:
    IntegrityLevel:
        - 'High'
        - 'System'
        - 'S-1-16-16384'
        - 'S-1-16-12288'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	eq	`C:\Program Files\Windows Media Player\osk.exe` `C:\Windows\System32\cmd.exe` corpus 2 (sigma 2)	`field:"Image" kind:eq`
`IntegrityLevel`	eq	`High` corpus 18 (sigma 17, splunk 1) `S-1-16-12288` corpus 18 (sigma 17, splunk 1) `S-1-16-16384` corpus 31 (sigma 22, splunk 5, elastic 3, kusto 1) `System` corpus 31 (sigma 22, splunk 5, elastic 3, kusto 1)	`field:"IntegrityLevel" kind:eq`
`ParentCommandLine`	eq	`"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s`	`field:"ParentCommandLine" kind:eq`

UNC2452 PowerShell Pattern

Status: test
Severity: critical
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation `T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: UNC2452 PowerShell Pattern
id: b7155193-8a81-4d8f-805d-88de864ca50c
status: test
description: Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports
references:
    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware
    - https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-7---create-a-process-using-wmi-query-and-an-encoded-command
author: Florian Roth (Nextron Systems)
date: 2021-01-20
modified: 2022-10-09
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1047
    - detection.emerging-threats
    # - sunburst
logsource:
    category: process_creation
    product: windows
detection:
    selection_cli_1:
        CommandLine|contains|all:
            - 'Invoke-WMIMethod win32_process -name create -argumentlist'
            - 'rundll32 c:\windows'
    selection_cli_2:
        CommandLine|contains|all:
            - 'wmic /node:'
            - 'process call create "rundll32 c:\windows'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_cli_1`

selection_cli_1:
    CommandLine|contains|all:
        - 'Invoke-WMIMethod win32_process -name create -argumentlist'
        - 'rundll32 c:\windows'

Stage 2: `selection_cli_2`

selection_cli_2:
    CommandLine|contains|all:
        - 'wmic /node:'
        - 'process call create "rundll32 c:\windows'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`Invoke-WMIMethod win32_process -name create -argumentlist` `process call create "rundll32 c:\windows` `rundll32 c:\windows` `wmic /node:`	`field:"CommandLine" kind:match`

Ursnif Malware Download URL Pattern

Status: stable
Severity: high
Author: Thomas Patzke
Source: github.com/SigmaHQ/sigma

Detects download of Ursnif malware done by dropper documents.

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1071.001` Application Layer Protocol: Web Protocols

Rule Body

title: Ursnif Malware Download URL Pattern
id: a36ce77e-30db-4ea0-8795-644d7af5dfb4
status: stable
description: Detects download of Ursnif malware done by dropper documents.
references:
    - https://notebook.community/Cyb3rWard0g/HELK/docker/helk-jupyter/notebooks/sigma/proxy_ursnif_malware
author: Thomas Patzke
date: 2019-12-19
modified: 2022-08-15
logsource:
    category: proxy
tags:
    - attack.command-and-control
    - attack.t1071.001
    - detection.emerging-threats
detection:
    selection:
        c-uri|contains|all:
            - '/'
            - '.php\?l='
        c-uri|endswith: '.cab'
        sc-status: 200
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    c-uri|contains|all:
        - '/'
        - '.php\?l='
    c-uri|endswith: '.cab'
    sc-status: 200

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`c-uri`	ends_with	`.cab`	`field:"c-uri" kind:ends_with value:".cab"`
`c-uri`	match	`.php\?l=` `/`	`field:"c-uri" kind:match`
`sc-status`	eq	`200`	`field:"sc-status" kind:eq value:"200"`

Use of UltraVNC Remote Access Software

Status: test
Severity: medium
Author: frack113
Source: github.com/SigmaHQ/sigma

An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

Known False Positives

Legitimate use

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1219.002` Remote Access Tools: Remote Desktop Software

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Use of UltraVNC Remote Access Software
id: 145322e4-0fd3-486b-81ca-9addc75736d8
status: test
description: An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1219/T1219.md
author: frack113
date: 2022-10-02
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Description: VNCViewer
        - Product: UltraVNC VNCViewer
        - Company: UltraVNC
        - OriginalFileName: VNCViewer.exe
    condition: selection
falsepositives:
    - Legitimate use
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Description: VNCViewer
    - Product: UltraVNC VNCViewer
    - Company: UltraVNC
    - OriginalFileName: VNCViewer.exe

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Company`	eq	`UltraVNC`	`field:"Company" kind:eq value:"UltraVNC"`
`Description`	eq	`VNCViewer`	`field:"Description" kind:eq value:"VNCViewer"`
`OriginalFileName`	eq	`VNCViewer.exe`	`field:"OriginalFileName" kind:eq value:"VNCViewer.exe"`
`Product`	eq	`UltraVNC VNCViewer`	`field:"Product" kind:eq value:"UltraVNC VNCViewer"`

User Added to Local Administrator Group

Status: stable
Severity: medium
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

Known False Positives

Legitimate administrative activity

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts `T1098` Account Manipulation
Privilege Escalation	`T1078` Valid Accounts `T1098` Account Manipulation
Stealth	`T1078` Valid Accounts

Telemetry Coverage

Provider	Record / event type
Security-Auditing	Event ID 4732: A member was added to a security-enabled local group.

Rule Body

title: User Added to Local Administrator Group
id: c265cf08-3f99-46c1-8d59-328247057d57
status: stable
description: Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732
    - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
author: Florian Roth (Nextron Systems)
date: 2017-03-14
modified: 2021-01-17
tags:
    - attack.initial-access
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.t1098
logsource:
    product: windows
    service: security
detection:
    selection_eid:
        EventID: 4732
    selection_group:
        - TargetUserName|startswith: 'Administr'
        - TargetSid: 'S-1-5-32-544'
    filter_main_computer_accounts:
        SubjectUserName|endswith: '$'
    condition: all of selection_* and not 1 of filter_*
falsepositives:
    - Legitimate administrative activity
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_*

Stage 1: `selection_eid`

selection_eid:
    EventID: 4732

Stage 2: `selection_group`

selection_group:
    - TargetUserName|startswith: 'Administr'
    - TargetSid: 'S-1-5-32-544'

Stage 3: `not filter_main_computer_accounts`

filter_main_computer_accounts:
    SubjectUserName|endswith: '$'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetSid`	eq	`S-1-5-32-544` corpus 2 (sigma 2)	`field:"TargetSid" kind:eq value:"S-1-5-32-544"`
`TargetUserName`	starts_with	`Administr` corpus 2 (sigma 2)	`field:"TargetUserName" kind:starts_with value:"Administr"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

User Shell Folders Registry Modification via CommandLine

Status: experimental
Severity: high
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.

Known False Positives

Usage of reg.exe or PowerShell to modify User Shell Folders for legitimate purposes; but rare.

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry `T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Defense Impairment	`T1112` Modify Registry

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: User Shell Folders Registry Modification via CommandLine
id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818
related:
    - id: 9c226817-8dc9-46c2-a58d-66655aafd7dc
      type: similar
status: experimental
description: |
    Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts.
    Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup.
    This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.
references:
    - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-01-05
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1547.001
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\reg.exe'
        - OriginalFileName:
              - 'powershell.exe'
              - 'pwsh.dll'
              - 'reg.exe'
    selection_cli_action:
        CommandLine|contains:
            - ' add ' # reg.exe modification
            - 'New-ItemProperty'
            - 'Set-ItemProperty'
            - 'si ' # short for Set-ItemProperty
    selection_cli_paths_root:
        CommandLine|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders'
            - '\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'
    selection_cli_paths_suffix:
        CommandLine|contains: 'Startup' # covers both 'Startup' and 'Common Startup'
    condition: all of selection_*
falsepositives:
    - Usage of reg.exe or PowerShell to modify User Shell Folders for legitimate purposes; but rare.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification/info.yml
simulation:
    - type: atomic-red-team
      name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
      technique: T1547.001
      atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\reg.exe'
    - OriginalFileName:
          - 'powershell.exe'
          - 'pwsh.dll'
          - 'reg.exe'

Stage 2: `selection_cli_action`

selection_cli_action:
    CommandLine|contains:
        - ' add '
        - 'New-ItemProperty'
        - 'Set-ItemProperty'
        - 'si '

Stage 3: `selection_cli_paths_root`

selection_cli_paths_root:
    CommandLine|contains:
        - '\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders'
        - '\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'

Stage 4: `selection_cli_paths_suffix`

selection_cli_paths_suffix:
    CommandLine|contains: 'Startup'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`add` corpus 14 (sigma 13, splunk 1) `New-ItemProperty` corpus 7 (sigma 7) `Set-ItemProperty` corpus 7 (sigma 7) `Startup` corpus 2 (sigma 2) `\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders` `\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders` `si` corpus 5 (sigma 5)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\powershell.exe` corpus 181 (sigma 180, splunk 1) `\pwsh.exe` corpus 166 (sigma 166) `\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`powershell.exe` corpus 134 (sigma 86, splunk 30, elastic 18) `pwsh.dll` corpus 115 (sigma 81, splunk 30, elastic 4) `reg.exe` corpus 41 (sigma 32, splunk 8, elastic 1)	`field:"OriginalFileName" kind:eq`

Back to all Sigma rules

Sigma rules: 10

.Class Extension URI Ending Request

MITRE ATT&CK Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Active Directory Database Snapshot Via ADExplorer

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli

Indicators

ADSI-Cache File Creation By Uncommon Tool

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Stage 2: not filter_main_*

Stage 3: not filter_optional_*

Indicators

Exclusions

Attempt To Create API Key

MITRE ATT&CK Coverage

Rules Detecting the Same Action

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

AWS EKS Cluster Created or Deleted

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Azure Virtual Network Device Modified or Deleted

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Computer System Reconnaissance Via Wmic.EXE

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli

Indicators

Creation of a Local Hidden User Account by Registry

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Download From Suspicious TLD - Whitelist

Known False Positives

MITRE ATT&CK Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Stage 2: not filter

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli`

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter_main_*`

Stage 3: `not filter_optional_*`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter`

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli`

Stage 3: `selection_extension`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection1`

Stage 2: `selection3`

Stage 3: `selection4`

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli`

Stage 3: `selection_quiet`

Stage 4: `not filter_main_*`

Stage 5: `not filter_optional_*`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection_img`